Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2023, 11:52

General

  • Target

    8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe

  • Size

    5.8MB

  • MD5

    dde5b7a0f954e8263b022811c3305866

  • SHA1

    151ccc12e558bd3fb7a2014c25b75f052319f61e

  • SHA256

    8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3

  • SHA512

    57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305

  • SSDEEP

    98304:NTE6ZBd1H4f9dqvy6BockCIUS1OtWq+StwuowSLokM6VoA0DTtrlK58vGz+Tf4Ay:NT7LQ0ao8CIUCUWqFm11Q6Vo9thK/ziT

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
    "C:\Users\Admin\AppData\Local\Temp\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1080
    • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
      "F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2800
      • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe
        "F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:2496
      • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
        F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2544
        • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe
          "F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"
          4⤵
          • Executes dropped EXE
          PID:1332
        • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
          F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Writes to the Master Boot Record (MBR)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:580
          • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe
            "F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            PID:1352
          • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
            F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Writes to the Master Boot Record (MBR)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1644
            • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe
              "F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"
              6⤵
              • Executes dropped EXE
              • Enumerates connected drives
              PID:1008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe

    Filesize

    5.8MB

    MD5

    dde5b7a0f954e8263b022811c3305866

    SHA1

    151ccc12e558bd3fb7a2014c25b75f052319f61e

    SHA256

    8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3

    SHA512

    57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe

    Filesize

    5.8MB

    MD5

    dde5b7a0f954e8263b022811c3305866

    SHA1

    151ccc12e558bd3fb7a2014c25b75f052319f61e

    SHA256

    8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3

    SHA512

    57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe

    Filesize

    5.8MB

    MD5

    dde5b7a0f954e8263b022811c3305866

    SHA1

    151ccc12e558bd3fb7a2014c25b75f052319f61e

    SHA256

    8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3

    SHA512

    57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe

    Filesize

    5.8MB

    MD5

    dde5b7a0f954e8263b022811c3305866

    SHA1

    151ccc12e558bd3fb7a2014c25b75f052319f61e

    SHA256

    8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3

    SHA512

    57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe

    Filesize

    5.8MB

    MD5

    dde5b7a0f954e8263b022811c3305866

    SHA1

    151ccc12e558bd3fb7a2014c25b75f052319f61e

    SHA256

    8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3

    SHA512

    57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\Hero.ini

    Filesize

    53B

    MD5

    87b828f00e8a78f1d0b8c34d672b53a5

    SHA1

    186c545bbd56a0086fbcf302dac6f7365676b087

    SHA256

    7f89dc9a76fd40ffd15196ca0fb37ac8fb49084fe3ea68f0a42cbd577177d1a3

    SHA512

    72cd61df813e3f0f18daa95a70ec7313b520587c92eaa0af0cfb6b4512ebe0bf77975659ab06f36d3546c336f9bd36e36fd04a949112aefa652e22addccb08bc

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\Hero.ini

    Filesize

    53B

    MD5

    87b828f00e8a78f1d0b8c34d672b53a5

    SHA1

    186c545bbd56a0086fbcf302dac6f7365676b087

    SHA256

    7f89dc9a76fd40ffd15196ca0fb37ac8fb49084fe3ea68f0a42cbd577177d1a3

    SHA512

    72cd61df813e3f0f18daa95a70ec7313b520587c92eaa0af0cfb6b4512ebe0bf77975659ab06f36d3546c336f9bd36e36fd04a949112aefa652e22addccb08bc

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\Hero.ini

    Filesize

    53B

    MD5

    3b773fa1b0ff8685cad90d6b0bd580f0

    SHA1

    df789a8b9570f6df9b4b74db60b8f5f081ab8030

    SHA256

    07ccd166d5da19e9ce830836e875d78972ada3fbfe517f3b3bc3ef6caa2a4ad5

    SHA512

    5a237020f05a7a1fdb32c3c6a79740e3f9f080af41f1746271ce7e6fa5df103f8527a02ba802307f08e8ac5732851e386779ee7aa050d311f3bd1680c3a0282f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\Hero.ini

    Filesize

    53B

    MD5

    87b828f00e8a78f1d0b8c34d672b53a5

    SHA1

    186c545bbd56a0086fbcf302dac6f7365676b087

    SHA256

    7f89dc9a76fd40ffd15196ca0fb37ac8fb49084fe3ea68f0a42cbd577177d1a3

    SHA512

    72cd61df813e3f0f18daa95a70ec7313b520587c92eaa0af0cfb6b4512ebe0bf77975659ab06f36d3546c336f9bd36e36fd04a949112aefa652e22addccb08bc

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe

    Filesize

    4.5MB

    MD5

    eb9d82eba00cb9f6f00ff1307974042e

    SHA1

    48040d87fe5febcd1e825aaacd8ae3a605f3bc19

    SHA256

    c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd

    SHA512

    10e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f

  • memory/580-295-0x0000000006990000-0x00000000069A0000-memory.dmp

    Filesize

    64KB

  • memory/580-308-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/580-233-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/580-236-0x00000000003D0000-0x00000000003DB000-memory.dmp

    Filesize

    44KB

  • memory/580-238-0x00000000003E0000-0x00000000003EB000-memory.dmp

    Filesize

    44KB

  • memory/580-240-0x00000000003F0000-0x00000000003F8000-memory.dmp

    Filesize

    32KB

  • memory/580-356-0x0000000006990000-0x00000000069A0000-memory.dmp

    Filesize

    64KB

  • memory/580-244-0x00000000010F0000-0x00000000010F7000-memory.dmp

    Filesize

    28KB

  • memory/580-313-0x00000000003F0000-0x00000000003F8000-memory.dmp

    Filesize

    32KB

  • memory/580-314-0x00000000010F0000-0x00000000010F7000-memory.dmp

    Filesize

    28KB

  • memory/580-309-0x00000000003D0000-0x00000000003DB000-memory.dmp

    Filesize

    44KB

  • memory/580-304-0x0000000007A70000-0x00000000085E2000-memory.dmp

    Filesize

    11.4MB

  • memory/1080-61-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/1080-89-0x0000000000260000-0x000000000026B000-memory.dmp

    Filesize

    44KB

  • memory/1080-86-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/1080-87-0x0000000004570000-0x0000000005260000-memory.dmp

    Filesize

    12.9MB

  • memory/1080-54-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/1080-88-0x0000000000250000-0x000000000025B000-memory.dmp

    Filesize

    44KB

  • memory/1080-62-0x0000000000280000-0x0000000000287000-memory.dmp

    Filesize

    28KB

  • memory/1080-63-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1080-60-0x0000000000270000-0x0000000000278000-memory.dmp

    Filesize

    32KB

  • memory/1080-58-0x0000000000260000-0x000000000026B000-memory.dmp

    Filesize

    44KB

  • memory/1080-56-0x0000000000250000-0x000000000025B000-memory.dmp

    Filesize

    44KB

  • memory/1332-226-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1332-229-0x0000000000400000-0x0000000000F72000-memory.dmp

    Filesize

    11.4MB

  • memory/1332-222-0x0000000000400000-0x0000000000F72000-memory.dmp

    Filesize

    11.4MB

  • memory/1332-227-0x0000000002BB0000-0x0000000002C67000-memory.dmp

    Filesize

    732KB

  • memory/1352-305-0x0000000000400000-0x0000000000F72000-memory.dmp

    Filesize

    11.4MB

  • memory/1352-311-0x0000000002CC0000-0x0000000002D77000-memory.dmp

    Filesize

    732KB

  • memory/1352-310-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1352-315-0x0000000000400000-0x0000000000F72000-memory.dmp

    Filesize

    11.4MB

  • memory/1644-354-0x00000000003B0000-0x00000000003B7000-memory.dmp

    Filesize

    28KB

  • memory/1644-318-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/1644-349-0x00000000003A0000-0x00000000003A8000-memory.dmp

    Filesize

    32KB

  • memory/1644-320-0x0000000000370000-0x000000000037B000-memory.dmp

    Filesize

    44KB

  • memory/1644-322-0x0000000000380000-0x000000000038B000-memory.dmp

    Filesize

    44KB

  • memory/2496-137-0x0000000000400000-0x0000000000F72000-memory.dmp

    Filesize

    11.4MB

  • memory/2496-146-0x0000000003860000-0x0000000003917000-memory.dmp

    Filesize

    732KB

  • memory/2496-140-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2496-141-0x0000000003860000-0x0000000003917000-memory.dmp

    Filesize

    732KB

  • memory/2496-139-0x0000000000400000-0x0000000000F72000-memory.dmp

    Filesize

    11.4MB

  • memory/2496-145-0x0000000000400000-0x0000000000F72000-memory.dmp

    Filesize

    11.4MB

  • memory/2544-150-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/2544-220-0x0000000007A80000-0x00000000085F2000-memory.dmp

    Filesize

    11.4MB

  • memory/2544-250-0x0000000007A80000-0x00000000085F2000-memory.dmp

    Filesize

    11.4MB

  • memory/2544-219-0x0000000007A80000-0x00000000085F2000-memory.dmp

    Filesize

    11.4MB

  • memory/2544-286-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/2544-242-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

    Filesize

    64KB

  • memory/2544-208-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/2544-223-0x0000000000280000-0x0000000000287000-memory.dmp

    Filesize

    28KB

  • memory/2544-218-0x0000000000250000-0x000000000025B000-memory.dmp

    Filesize

    44KB

  • memory/2544-209-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

    Filesize

    64KB

  • memory/2544-155-0x0000000000260000-0x000000000026B000-memory.dmp

    Filesize

    44KB

  • memory/2544-224-0x0000000000270000-0x0000000000278000-memory.dmp

    Filesize

    32KB

  • memory/2800-124-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

    Filesize

    64KB

  • memory/2800-98-0x0000000000300000-0x0000000000307000-memory.dmp

    Filesize

    28KB

  • memory/2800-144-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/2800-138-0x00000000002E0000-0x00000000002EB000-memory.dmp

    Filesize

    44KB

  • memory/2800-96-0x00000000002F0000-0x00000000002F8000-memory.dmp

    Filesize

    32KB

  • memory/2800-149-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

    Filesize

    64KB

  • memory/2800-136-0x0000000007960000-0x00000000084D2000-memory.dmp

    Filesize

    11.4MB

  • memory/2800-154-0x0000000007960000-0x00000000084D2000-memory.dmp

    Filesize

    11.4MB

  • memory/2800-94-0x00000000002E0000-0x00000000002EB000-memory.dmp

    Filesize

    44KB

  • memory/2800-199-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/2800-90-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/2800-92-0x00000000002D0000-0x00000000002DB000-memory.dmp

    Filesize

    44KB

  • memory/2800-135-0x0000000007960000-0x00000000084D2000-memory.dmp

    Filesize

    11.4MB

  • memory/2800-134-0x00000000002D0000-0x00000000002DB000-memory.dmp

    Filesize

    44KB

  • memory/2800-133-0x0000000000400000-0x00000000010F0000-memory.dmp

    Filesize

    12.9MB

  • memory/2800-117-0x0000000000300000-0x0000000000307000-memory.dmp

    Filesize

    28KB

  • memory/2800-115-0x00000000002F0000-0x00000000002F8000-memory.dmp

    Filesize

    32KB