Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 03:43

General

  • Target

    712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe

  • Size

    45KB

  • MD5

    065403bcd78f5ef01ae779a88cd50eb7

  • SHA1

    447f03c372852d16856e22410e56d2b1a2d0dd5d

  • SHA256

    712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734

  • SHA512

    9095d612418f75d7253cc9aadda4412a2137832a4095be1eaeafb5fea05eb94ac8a2c86495c3cd1700c411fe545192f8db953b92720704e904c6e6c9e942f175

  • SSDEEP

    768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXa:EOxyeFo6NPCAosxYyXdF5oy3VoKa

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
  • Executes dropped EXE 15 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 29 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
    "C:\Users\Admin\AppData\Local\Temp\712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4940
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1220
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\recycled\SVCHOST.EXE
          C:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4312
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3328
        • C:\recycled\CTFMON.EXE
          C:\recycled\CTFMON.EXE :agent
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\recycled\SVCHOST.EXE
            C:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2336
          • C:\recycled\SPOOLSV.EXE
            C:\recycled\SPOOLSV.EXE :agent
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3228
          • C:\recycled\CTFMON.EXE
            C:\recycled\CTFMON.EXE :agent
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4400
      • C:\recycled\CTFMON.EXE
        C:\recycled\CTFMON.EXE :agent
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3780
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4224
        • C:\Windows\SysWOW64\Explorer.exe
          Explorer.exe "C:\recycled\SVCHOST.exe"
          4⤵
            PID:4812
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2596
      • C:\recycled\CTFMON.EXE
        C:\recycled\CTFMON.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4832
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3748
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4880
      • C:\recycled\CTFMON.EXE
        C:\recycled\CTFMON.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4964
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.doc" /o ""
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3588
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:3380

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Recycled\CTFMON.EXE

        Filesize

        45KB

        MD5

        d2276d098faf924760bc6f6386fb3110

        SHA1

        553e6b7e2de1f25c3f5483b3ffd012267ca9000a

        SHA256

        078eeba490b828ce25ab16c8a52a5c1359ccbec749042de8453c348d2a5d7f0d

        SHA512

        47dade5d86f0654f5608b6fdea599e248df13babdbc85291df19291e6aa5dcd572f4c01df7c4bc81357bb3e742419e5cf0786393462658245d9cb78e49ac627b

      • C:\Recycled\CTFMON.EXE

        Filesize

        45KB

        MD5

        d2276d098faf924760bc6f6386fb3110

        SHA1

        553e6b7e2de1f25c3f5483b3ffd012267ca9000a

        SHA256

        078eeba490b828ce25ab16c8a52a5c1359ccbec749042de8453c348d2a5d7f0d

        SHA512

        47dade5d86f0654f5608b6fdea599e248df13babdbc85291df19291e6aa5dcd572f4c01df7c4bc81357bb3e742419e5cf0786393462658245d9cb78e49ac627b

      • C:\Recycled\CTFMON.EXE

        Filesize

        45KB

        MD5

        d2276d098faf924760bc6f6386fb3110

        SHA1

        553e6b7e2de1f25c3f5483b3ffd012267ca9000a

        SHA256

        078eeba490b828ce25ab16c8a52a5c1359ccbec749042de8453c348d2a5d7f0d

        SHA512

        47dade5d86f0654f5608b6fdea599e248df13babdbc85291df19291e6aa5dcd572f4c01df7c4bc81357bb3e742419e5cf0786393462658245d9cb78e49ac627b

      • C:\Recycled\CTFMON.EXE

        Filesize

        45KB

        MD5

        d2276d098faf924760bc6f6386fb3110

        SHA1

        553e6b7e2de1f25c3f5483b3ffd012267ca9000a

        SHA256

        078eeba490b828ce25ab16c8a52a5c1359ccbec749042de8453c348d2a5d7f0d

        SHA512

        47dade5d86f0654f5608b6fdea599e248df13babdbc85291df19291e6aa5dcd572f4c01df7c4bc81357bb3e742419e5cf0786393462658245d9cb78e49ac627b

      • C:\Recycled\CTFMON.EXE

        Filesize

        45KB

        MD5

        d2276d098faf924760bc6f6386fb3110

        SHA1

        553e6b7e2de1f25c3f5483b3ffd012267ca9000a

        SHA256

        078eeba490b828ce25ab16c8a52a5c1359ccbec749042de8453c348d2a5d7f0d

        SHA512

        47dade5d86f0654f5608b6fdea599e248df13babdbc85291df19291e6aa5dcd572f4c01df7c4bc81357bb3e742419e5cf0786393462658245d9cb78e49ac627b

      • C:\Recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        6eee27c4cf4c2c313c23e1931697904c

        SHA1

        4bfe4ce686008346b845ec9fecc2dd6f0f8fafe1

        SHA256

        3b0bafa5c85bdd4c0ee582f3a1d73206c714956fde4495d0c080eadf4e7d166b

        SHA512

        90699a1b76b81e7f102fa7de18770d70861c82fa6f68d1c1903bc510847bcfd37cb79b8e93acc1f4a7c748522402ee38211c66cc0bcb595912280650d74c3096

      • C:\Recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        6eee27c4cf4c2c313c23e1931697904c

        SHA1

        4bfe4ce686008346b845ec9fecc2dd6f0f8fafe1

        SHA256

        3b0bafa5c85bdd4c0ee582f3a1d73206c714956fde4495d0c080eadf4e7d166b

        SHA512

        90699a1b76b81e7f102fa7de18770d70861c82fa6f68d1c1903bc510847bcfd37cb79b8e93acc1f4a7c748522402ee38211c66cc0bcb595912280650d74c3096

      • C:\Recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        6eee27c4cf4c2c313c23e1931697904c

        SHA1

        4bfe4ce686008346b845ec9fecc2dd6f0f8fafe1

        SHA256

        3b0bafa5c85bdd4c0ee582f3a1d73206c714956fde4495d0c080eadf4e7d166b

        SHA512

        90699a1b76b81e7f102fa7de18770d70861c82fa6f68d1c1903bc510847bcfd37cb79b8e93acc1f4a7c748522402ee38211c66cc0bcb595912280650d74c3096

      • C:\Recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        6eee27c4cf4c2c313c23e1931697904c

        SHA1

        4bfe4ce686008346b845ec9fecc2dd6f0f8fafe1

        SHA256

        3b0bafa5c85bdd4c0ee582f3a1d73206c714956fde4495d0c080eadf4e7d166b

        SHA512

        90699a1b76b81e7f102fa7de18770d70861c82fa6f68d1c1903bc510847bcfd37cb79b8e93acc1f4a7c748522402ee38211c66cc0bcb595912280650d74c3096

      • C:\Recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        6eee27c4cf4c2c313c23e1931697904c

        SHA1

        4bfe4ce686008346b845ec9fecc2dd6f0f8fafe1

        SHA256

        3b0bafa5c85bdd4c0ee582f3a1d73206c714956fde4495d0c080eadf4e7d166b

        SHA512

        90699a1b76b81e7f102fa7de18770d70861c82fa6f68d1c1903bc510847bcfd37cb79b8e93acc1f4a7c748522402ee38211c66cc0bcb595912280650d74c3096

      • C:\Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        4f010b86e41e1ce4b8a1d7d26bac7ced

        SHA1

        e62ddc3a065b60859bd3fb20a243f2deff39bec1

        SHA256

        db331d2fe1018f5b527dd45a7e2f5ea6907320b4b4b6c92d0aea440794b427a9

        SHA512

        2c202a0598aaa870d323388fbe46ad110f1eefa2c7e73094c7fe4dce37d46ab48549beb645ac2d429929252c5f25f6b709d07b2b80bc9593bcb3d081dd76014d

      • C:\Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        4f010b86e41e1ce4b8a1d7d26bac7ced

        SHA1

        e62ddc3a065b60859bd3fb20a243f2deff39bec1

        SHA256

        db331d2fe1018f5b527dd45a7e2f5ea6907320b4b4b6c92d0aea440794b427a9

        SHA512

        2c202a0598aaa870d323388fbe46ad110f1eefa2c7e73094c7fe4dce37d46ab48549beb645ac2d429929252c5f25f6b709d07b2b80bc9593bcb3d081dd76014d

      • C:\Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        4f010b86e41e1ce4b8a1d7d26bac7ced

        SHA1

        e62ddc3a065b60859bd3fb20a243f2deff39bec1

        SHA256

        db331d2fe1018f5b527dd45a7e2f5ea6907320b4b4b6c92d0aea440794b427a9

        SHA512

        2c202a0598aaa870d323388fbe46ad110f1eefa2c7e73094c7fe4dce37d46ab48549beb645ac2d429929252c5f25f6b709d07b2b80bc9593bcb3d081dd76014d

      • C:\Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        4f010b86e41e1ce4b8a1d7d26bac7ced

        SHA1

        e62ddc3a065b60859bd3fb20a243f2deff39bec1

        SHA256

        db331d2fe1018f5b527dd45a7e2f5ea6907320b4b4b6c92d0aea440794b427a9

        SHA512

        2c202a0598aaa870d323388fbe46ad110f1eefa2c7e73094c7fe4dce37d46ab48549beb645ac2d429929252c5f25f6b709d07b2b80bc9593bcb3d081dd76014d

      • C:\Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        4f010b86e41e1ce4b8a1d7d26bac7ced

        SHA1

        e62ddc3a065b60859bd3fb20a243f2deff39bec1

        SHA256

        db331d2fe1018f5b527dd45a7e2f5ea6907320b4b4b6c92d0aea440794b427a9

        SHA512

        2c202a0598aaa870d323388fbe46ad110f1eefa2c7e73094c7fe4dce37d46ab48549beb645ac2d429929252c5f25f6b709d07b2b80bc9593bcb3d081dd76014d

      • C:\Recycled\desktop.ini

        Filesize

        65B

        MD5

        ad0b0b4416f06af436328a3c12dc491b

        SHA1

        743c7ad130780de78ccbf75aa6f84298720ad3fa

        SHA256

        23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416

        SHA512

        884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56

      • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

        Filesize

        1KB

        MD5

        0269b6347e473980c5378044ac67aa1f

        SHA1

        c3334de50e320ad8bce8398acff95c363d039245

        SHA256

        68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

        SHA512

        e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

      • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

        Filesize

        1KB

        MD5

        0269b6347e473980c5378044ac67aa1f

        SHA1

        c3334de50e320ad8bce8398acff95c363d039245

        SHA256

        68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

        SHA512

        e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

      • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

        Filesize

        1KB

        MD5

        0269b6347e473980c5378044ac67aa1f

        SHA1

        c3334de50e320ad8bce8398acff95c363d039245

        SHA256

        68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

        SHA512

        e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

      • C:\begolu.txt

        Filesize

        2B

        MD5

        2b9d4fa85c8e82132bde46b143040142

        SHA1

        a02431cf7c501a5b368c91e41283419d8fa9fb03

        SHA256

        4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

        SHA512

        c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

      • C:\recycled\CTFMON.EXE

        Filesize

        45KB

        MD5

        d2276d098faf924760bc6f6386fb3110

        SHA1

        553e6b7e2de1f25c3f5483b3ffd012267ca9000a

        SHA256

        078eeba490b828ce25ab16c8a52a5c1359ccbec749042de8453c348d2a5d7f0d

        SHA512

        47dade5d86f0654f5608b6fdea599e248df13babdbc85291df19291e6aa5dcd572f4c01df7c4bc81357bb3e742419e5cf0786393462658245d9cb78e49ac627b

      • C:\recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        6eee27c4cf4c2c313c23e1931697904c

        SHA1

        4bfe4ce686008346b845ec9fecc2dd6f0f8fafe1

        SHA256

        3b0bafa5c85bdd4c0ee582f3a1d73206c714956fde4495d0c080eadf4e7d166b

        SHA512

        90699a1b76b81e7f102fa7de18770d70861c82fa6f68d1c1903bc510847bcfd37cb79b8e93acc1f4a7c748522402ee38211c66cc0bcb595912280650d74c3096

      • C:\recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        4f010b86e41e1ce4b8a1d7d26bac7ced

        SHA1

        e62ddc3a065b60859bd3fb20a243f2deff39bec1

        SHA256

        db331d2fe1018f5b527dd45a7e2f5ea6907320b4b4b6c92d0aea440794b427a9

        SHA512

        2c202a0598aaa870d323388fbe46ad110f1eefa2c7e73094c7fe4dce37d46ab48549beb645ac2d429929252c5f25f6b709d07b2b80bc9593bcb3d081dd76014d

      • memory/1220-147-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1644-167-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1644-231-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2336-175-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2596-196-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/3228-179-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/3328-161-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/3588-225-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

        Filesize

        64KB

      • memory/3588-226-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

        Filesize

        64KB

      • memory/3588-223-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

        Filesize

        64KB

      • memory/3588-227-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

        Filesize

        64KB

      • memory/3588-228-0x00007FFDBBF80000-0x00007FFDBBF90000-memory.dmp

        Filesize

        64KB

      • memory/3588-229-0x00007FFDBBF80000-0x00007FFDBBF90000-memory.dmp

        Filesize

        64KB

      • memory/3588-224-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

        Filesize

        64KB

      • memory/3748-208-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/3780-190-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4312-157-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4400-185-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4776-168-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4776-232-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4832-201-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4832-200-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4880-212-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4940-140-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4940-230-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4964-218-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/5076-222-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/5076-132-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB