Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 20:11

General

  • Target

    mkhg_Invoice_PurpleFox.msi

  • Size

    2.9MB

  • MD5

    eb9a4cf233789b96f940be0186a26988

  • SHA1

    002a1cee740fa212732379d1f00dbcf7c0cccbf2

  • SHA256

    24d40ba4bf19e3cb942918eb8091ab467b11d5d737aef8e37cffc5306d0081d8

  • SHA512

    725eefc24cf43ad0d5022f20608b1d149e9a4285cde7dc21b621aca3647d402a2ac7a2c0751614bae5f6d98c2b52e280e471f7f67f8916041c042bd1911784ce

  • SSDEEP

    49152:irOlrXVVdWi59GUrSLzeaVtFUaQfqZ2jQbfcOQHe1XPVZNA+ta7Knc9vQXBlBKFk:xlFFrEYY7LXPPdHsGBlB8h24BKM

Score
8/10

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
  • Loads dropped DLL 5 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 14 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\mkhg_Invoice_PurpleFox.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3500
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9788997D579157001DA4B5E58AB0CEA5
      2⤵
      • Loads dropped DLL
      PID:1000
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4D89DD1CC1F74DADE691F57AD41F30EB E Global\MSI0000
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Windows\SysWOW64\powercfg.exe
        "C:\Windows\SysWOW64\powercfg.exe" /S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5116
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 900; Restart-Computer -Force
        3⤵
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1556
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye
        3⤵
          PID:2780
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter1
          3⤵
            PID:4676
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
            3⤵
              PID:4432
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
              3⤵
                PID:940
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                3⤵
                  PID:2804
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                  3⤵
                    PID:3028
                  • C:\Windows\SysWOW64\netsh.exe
                    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                    3⤵
                      PID:5068
                    • C:\Windows\SysWOW64\netsh.exe
                      "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                      3⤵
                        PID:2476
                      • C:\Windows\SysWOW64\netsh.exe
                        "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=2222 protocol=TCP
                        3⤵
                          PID:4488
                        • C:\Windows\SysWOW64\netsh.exe
                          "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP
                          3⤵
                            PID:4732
                          • C:\Windows\SysWOW64\netsh.exe
                            "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=4444 protocol=TCP
                            3⤵
                              PID:1348
                            • C:\Windows\SysWOW64\netsh.exe
                              "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP
                              3⤵
                                PID:3592
                              • C:\Windows\SysWOW64\netsh.exe
                                "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=6666 protocol=TCP
                                3⤵
                                  PID:3732
                                • C:\Windows\SysWOW64\netsh.exe
                                  "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=7777 protocol=TCP
                                  3⤵
                                    PID:1936
                                  • C:\Windows\SysWOW64\netsh.exe
                                    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=8888 protocol=TCP
                                    3⤵
                                      PID:4304
                                    • C:\Windows\SysWOW64\netsh.exe
                                      "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP
                                      3⤵
                                        PID:644
                                      • C:\Windows\SysWOW64\netsh.exe
                                        "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9999 protocol=TCP
                                        3⤵
                                          PID:3788
                                        • C:\Windows\SysWOW64\netsh.exe
                                          "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14443 protocol=TCP
                                          3⤵
                                            PID:3140
                                          • C:\Windows\SysWOW64\netsh.exe
                                            "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14444 protocol=TCP
                                            3⤵
                                              PID:5068
                                            • C:\Windows\SysWOW64\netsh.exe
                                              "C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block
                                              3⤵
                                                PID:1340
                                              • C:\Windows\SysWOW64\netsh.exe
                                                "C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1
                                                3⤵
                                                  PID:412
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  "C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y
                                                  3⤵
                                                    PID:3436
                                                  • C:\Windows\SysWOW64\takeown.exe
                                                    "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\jscript.dll
                                                    3⤵
                                                    • Modifies file permissions
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3484
                                                  • C:\Windows\SysWOW64\cacls.exe
                                                    "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\jscript.dll /E /P everyone:N
                                                    3⤵
                                                      PID:848
                                                    • C:\Windows\SysWOW64\takeown.exe
                                                      "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\jscript.dll
                                                      3⤵
                                                      • Modifies file permissions
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4216
                                                    • C:\Windows\SysWOW64\cacls.exe
                                                      "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\jscript.dll /E /P everyone:N
                                                      3⤵
                                                        PID:3292
                                                      • C:\Windows\SysWOW64\takeown.exe
                                                        "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\cscript.exe
                                                        3⤵
                                                        • Modifies file permissions
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4840
                                                      • C:\Windows\SysWOW64\cacls.exe
                                                        "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\cscript.exe /E /P everyone:N
                                                        3⤵
                                                          PID:3544
                                                        • C:\Windows\SysWOW64\takeown.exe
                                                          "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\cscript.exe
                                                          3⤵
                                                          • Modifies file permissions
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4188
                                                        • C:\Windows\SysWOW64\cacls.exe
                                                          "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\cscript.exe /E /P everyone:N
                                                          3⤵
                                                            PID:1924
                                                          • C:\Windows\SysWOW64\takeown.exe
                                                            "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                            3⤵
                                                            • Modifies file permissions
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1604
                                                          • C:\Windows\SysWOW64\cacls.exe
                                                            "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N
                                                            3⤵
                                                              PID:4224
                                                            • C:\Windows\SysWOW64\takeown.exe
                                                              "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
                                                              3⤵
                                                              • Modifies file permissions
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1656
                                                            • C:\Windows\SysWOW64\cacls.exe
                                                              "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N
                                                              3⤵
                                                                PID:1800
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
                                                                3⤵
                                                                  PID:368
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\SysWOW64\reg.exe" delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
                                                                  3⤵
                                                                    PID:4452
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg /f
                                                                    3⤵
                                                                      PID:5108
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      "C:\Windows\SysWOW64\sc.exe" stop wmiApSrv
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      PID:2744
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      "C:\Windows\SysWOW64\sc.exe" config wmiApSrv start=disabled
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      PID:3068

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Config.Msi\e5784f2.rbs

                                                                  Filesize

                                                                  3KB

                                                                  MD5

                                                                  9df58e88574b86359622950f5fa6d6e1

                                                                  SHA1

                                                                  498e91041f771d480ee05e0e55f8451be28ddb27

                                                                  SHA256

                                                                  98627eefe0b605041f1e7ee53610c85db202020be4a1af4982140c3ea1981372

                                                                  SHA512

                                                                  a593c474c7c9d01f72a812d141edd419bde3ce616af64b649f10eddcc34a070248db9d77825cf5ec7faae9f1594b807db33273a3068228efe31bfe7c6d9bb4b2

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5dao1h1.ttg.ps1

                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                • C:\Windows\Installer\MSI85E9.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSI85E9.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSIF492.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSIF492.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSIF53F.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSIF53F.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSIF53F.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSIF56F.tmp

                                                                  Filesize

                                                                  537KB

                                                                  MD5

                                                                  d7ec04b009302b83da506b9c63ca775c

                                                                  SHA1

                                                                  6fa9ea09b71531754b4cd05814a91032229834c0

                                                                  SHA256

                                                                  00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

                                                                  SHA512

                                                                  171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

                                                                • C:\Windows\Installer\MSIF56F.tmp

                                                                  Filesize

                                                                  537KB

                                                                  MD5

                                                                  d7ec04b009302b83da506b9c63ca775c

                                                                  SHA1

                                                                  6fa9ea09b71531754b4cd05814a91032229834c0

                                                                  SHA256

                                                                  00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

                                                                  SHA512

                                                                  171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

                                                                • C:\Windows\Installer\MSIF5ED.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • C:\Windows\Installer\MSIF5ED.tmp

                                                                  Filesize

                                                                  379KB

                                                                  MD5

                                                                  305a50c391a94b42a68958f3f89906fb

                                                                  SHA1

                                                                  4110d68d71f3594f5d3bdfca91a1c759ab0105d4

                                                                  SHA256

                                                                  f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

                                                                  SHA512

                                                                  fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

                                                                • memory/1556-29-0x0000000004E30000-0x0000000004E40000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/1556-45-0x00000000062C0000-0x000000000630C000-memory.dmp

                                                                  Filesize

                                                                  304KB

                                                                • memory/1556-30-0x0000000005470000-0x0000000005A98000-memory.dmp

                                                                  Filesize

                                                                  6.2MB

                                                                • memory/1556-31-0x00000000052E0000-0x0000000005302000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/1556-32-0x0000000005380000-0x00000000053E6000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                • memory/1556-33-0x0000000005C50000-0x0000000005CB6000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                • memory/1556-27-0x0000000004CE0000-0x0000000004D16000-memory.dmp

                                                                  Filesize

                                                                  216KB

                                                                • memory/1556-43-0x0000000005E40000-0x0000000006194000-memory.dmp

                                                                  Filesize

                                                                  3.3MB

                                                                • memory/1556-44-0x0000000006290000-0x00000000062AE000-memory.dmp

                                                                  Filesize

                                                                  120KB

                                                                • memory/1556-28-0x0000000004E30000-0x0000000004E40000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/1556-46-0x0000000004E30000-0x0000000004E40000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/1556-47-0x00000000078D0000-0x0000000007F4A000-memory.dmp

                                                                  Filesize

                                                                  6.5MB

                                                                • memory/1556-48-0x0000000006780000-0x000000000679A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                • memory/1556-49-0x0000000073490000-0x0000000073C40000-memory.dmp

                                                                  Filesize

                                                                  7.7MB

                                                                • memory/1556-50-0x0000000004E30000-0x0000000004E40000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/1556-51-0x0000000004E30000-0x0000000004E40000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/1556-26-0x0000000073490000-0x0000000073C40000-memory.dmp

                                                                  Filesize

                                                                  7.7MB