Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2023, 15:08

General

  • Target

    https://www.blammed.lol/free

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.blammed.lol/free
    1⤵
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a95d46f8,0x7ff8a95d4708,0x7ff8a95d4718
      2⤵
        PID:1872
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        2⤵
          PID:3696
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
          2⤵
            PID:4532
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
            2⤵
              PID:3424
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
              2⤵
                PID:3836
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
                2⤵
                  PID:4340
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                  2⤵
                    PID:1992
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
                    2⤵
                      PID:428
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3396
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4784 /prefetch:8
                      2⤵
                        PID:2372
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                        2⤵
                          PID:4904
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                          2⤵
                            PID:4528
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
                            2⤵
                              PID:3544
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6368 /prefetch:8
                              2⤵
                                PID:4640
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:712
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                                2⤵
                                  PID:4840
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                                  2⤵
                                    PID:696
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2224,432363230494305560,1044843659528750872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:60
                                  • C:\Users\Admin\Downloads\ExternalFREE.exe
                                    "C:\Users\Admin\Downloads\ExternalFREE.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3980
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:2588
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:380
                                    • C:\Windows\system32\taskmgr.exe
                                      "C:\Windows\system32\taskmgr.exe" /7
                                      1⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:3820

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                                      Filesize

                                      893B

                                      MD5

                                      d4ae187b4574036c2d76b6df8a8c1a30

                                      SHA1

                                      b06f409fa14bab33cbaf4a37811b8740b624d9e5

                                      SHA256

                                      a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

                                      SHA512

                                      1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                                      Filesize

                                      252B

                                      MD5

                                      5ba39a4f0b0e282cb967a14c2c1cb665

                                      SHA1

                                      e2d242dd41159f6cc18e278d4c6626a8cf1cc20b

                                      SHA256

                                      5ed1784be3aedd90ef6f60731e71b932874feb50098a64a22eb5fcf6c4b40139

                                      SHA512

                                      89cb616539941790ae6ad7bf2e4ba7fbbf8fd90b032d08ada7c6ac39c702276f611b684d005213772115a08c4473640d312c1d61b87f1c9406fb1a278bb0fbbf

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      f6f47b83c67fe32ee32811d6611d269c

                                      SHA1

                                      b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

                                      SHA256

                                      ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

                                      SHA512

                                      6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      111B

                                      MD5

                                      285252a2f6327d41eab203dc2f402c67

                                      SHA1

                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                      SHA256

                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                      SHA512

                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      334B

                                      MD5

                                      51f39bfa91568a90746ededeb5b33edf

                                      SHA1

                                      e7922756fdf79fe813be012da751b3f39a0deccd

                                      SHA256

                                      a9be8abf132c02d00c79fa95c8f019fcc66cd8ae21d305c5f4a12b2858d72512

                                      SHA512

                                      4b125b667a12130d3a89016d5e172f8ed01f40b12825559c188880d58f0d0be182a207bf287a654789553d2a9e7ccb7a36e5abfebd651b79893e1b5cb1dce045

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      e4480b52f6d1c284006d2b85553ee199

                                      SHA1

                                      9407f1ad9e3d8e8c6b6a669f6d8a03e71c16dec2

                                      SHA256

                                      0f5590dc563e2f6f1e4fd552b4beadca53f5f64cfd5e4365e7f202d693c07369

                                      SHA512

                                      b0b478f29399078cb5fd909673ffb31361a5aeb2873cbad48ff9a36293d1a1e74db3abc6a11ae4dc69eed2bb0db26b5b87c05e8e50d8151b7bc3bd49674d0dc4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      825d3ff409043d3d4dc48ebd63e01b40

                                      SHA1

                                      6c2d04b1056270da621156a8294fb4ca348f692b

                                      SHA256

                                      3b662b436d11c983176a12b1f224a2464c4a138f816721781f00b08e32bd07ee

                                      SHA512

                                      c2a0f7b287e3d5679a36a78dfdeb910f8134b18ba324f6a56139d08e4020faef20c848d6c7be322bd9dc30bc8415348c1979111272201930064bd26285ac656f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      5544c64f2a8f49dabc19eb84267b1c9b

                                      SHA1

                                      c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

                                      SHA256

                                      a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

                                      SHA512

                                      38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      12KB

                                      MD5

                                      bfd769f6dd88439b5630be80412d4d86

                                      SHA1

                                      a81df7eb517a2e1fbca6357804c3d0a8003993ce

                                      SHA256

                                      f5f627e2f952bd3e7420c0df1d11fc424fd90a6b2dcb6824921f19fbff829c3b

                                      SHA512

                                      2bc242683e200af2c2a85cceaf808877bc790410659d730bf2089e80c6549e9f4259209ed42ef96b5b98facc599439bf84ca3acb7594572cf98a7c2ce0c67962

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      2480bd00d552e822a3de0ef36c88abab

                                      SHA1

                                      d8cfbd49e2e72cb29272c88820645f59967ed988

                                      SHA256

                                      aa61c2eb6f7de8b523351ee71357dd76738a7d23ef13b63500ed0acfe41e4362

                                      SHA512

                                      30de0ffc4c936fec1688e684bf9fa6a572e2c2e4746344dbb7f5c5942a208294a5dc816a1375a982f96c3e16fac7b7ceaf76a9bab3ae6a8f377cc246b249f6df

                                    • C:\Users\Admin\Downloads\ExternalFREE.exe

                                      Filesize

                                      1.5MB

                                      MD5

                                      0765ecf5c45c2c2b070ca1b50cca26aa

                                      SHA1

                                      46b72840981aa93b14676bf58aa1d673456a860b

                                      SHA256

                                      4ebd7f785c9338dc55c705c1e346f2a28a8ed00d67b0b7c2ec0cc80a0e343e3a

                                      SHA512

                                      a12ff21de1310713128322ba632a113724677c4a7f8ac03c12d1e7961cb4d74279b974688b5568ea4aaca1cfc6a2f476bb8fdcfa692db3135ba04c3cfa08f319

                                    • C:\Users\Admin\Downloads\Unconfirmed 324863.crdownload

                                      Filesize

                                      1.5MB

                                      MD5

                                      0765ecf5c45c2c2b070ca1b50cca26aa

                                      SHA1

                                      46b72840981aa93b14676bf58aa1d673456a860b

                                      SHA256

                                      4ebd7f785c9338dc55c705c1e346f2a28a8ed00d67b0b7c2ec0cc80a0e343e3a

                                      SHA512

                                      a12ff21de1310713128322ba632a113724677c4a7f8ac03c12d1e7961cb4d74279b974688b5568ea4aaca1cfc6a2f476bb8fdcfa692db3135ba04c3cfa08f319

                                    • \??\c:\users\admin\downloads\externalfree.exe

                                      Filesize

                                      1.5MB

                                      MD5

                                      0765ecf5c45c2c2b070ca1b50cca26aa

                                      SHA1

                                      46b72840981aa93b14676bf58aa1d673456a860b

                                      SHA256

                                      4ebd7f785c9338dc55c705c1e346f2a28a8ed00d67b0b7c2ec0cc80a0e343e3a

                                      SHA512

                                      a12ff21de1310713128322ba632a113724677c4a7f8ac03c12d1e7961cb4d74279b974688b5568ea4aaca1cfc6a2f476bb8fdcfa692db3135ba04c3cfa08f319

                                    • memory/3820-154-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-159-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-160-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-161-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-163-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-164-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-162-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-158-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-153-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3820-152-0x000002341C150000-0x000002341C151000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3980-198-0x00000000003C0000-0x000000000054A000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/3980-197-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3980-199-0x0000000004D70000-0x0000000004D80000-memory.dmp

                                      Filesize

                                      64KB