Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 07:29

General

  • Target

    40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe

  • Size

    1.4MB

  • MD5

    d679cf07aef6c469c53595761b78a608

  • SHA1

    3a31e04b6a0d406375648dca872873385b455996

  • SHA256

    40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44

  • SHA512

    f5b12f6b43f49a1cfd9201db712bfaae1ed42dd933aca7a8a25011856db3f5df093ffe2f00083e8d7d6b2644f40df9005145a69cc543ba329b986b6e3806642b

  • SSDEEP

    24576:IBvKKHgnhSC0badP0QiPYnSFELlFFx0A4cAhPSNfL1JD/tbOFmHPrEH7s:sKKAsadP0QiPzEz0AVISNT1JtMy1

Score
8/10

Malware Config

Signatures

  • Sets file execution options in registry 2 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Registers COM server for autorun 1 TTPs 11 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
    "C:\Users\Admin\AppData\Local\Temp\40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={CAEC6DD3-CA9A-F3F9-2FE5-E6561BA4C3EA}&lang=en-GB&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser"
      2⤵
      • Sets file execution options in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4644
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Modifies registry class
      PID:3416
    • C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
      2⤵
        PID:2480
      • C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
        "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
        2⤵
          PID:1064
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkRCMTAzNTUtMjVFQS00N0M4LTgzNEYtRDJCNTU4NTJDNDhCfSIgdXNlcmlkPSJ7NjlCNEZDRTYtMzhGOC00NUI0LUEzMjYtNDk5MkQyNkRCNjQ5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZCMEY2MDNFLUVGRUItNEFFNS05MDM1LTcxQUZCQzVCMzlBMn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zNTIiIGxhbmc9ImVuLUdCIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7Q0FFQzZERDMtQ0E5QS1GM0Y5LTJGRTUtRTY1NjFCQTRDM0VBfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI4MjgiLz48L2FwcD48L3JlcXVlc3Q-
        1⤵
          PID:4156
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
            2⤵
              PID:4352
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={CAEC6DD3-CA9A-F3F9-2FE5-E6561BA4C3EA}&lang=en-GB&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{2DB10355-25EA-47C8-834F-D2B55852C48B}"
            1⤵
              PID:3640
            • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
              "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
              1⤵
                PID:1432
                • C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\120.0.6099.130_chrome_installer.exe
                  "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\120.0.6099.130_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\guiA1A1.tmp"
                  2⤵
                    PID:2264
                    • C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
                      "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\guiA1A1.tmp"
                      3⤵
                        PID:1876
                        • C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
                          "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=120.0.6099.130 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7199f70f8,0x7ff7199f7104,0x7ff7199f7110
                          4⤵
                            PID:2948
                          • C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
                            "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                            4⤵
                              PID:1368
                              • C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
                                "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=120.0.6099.130 --initial-client-data=0x268,0x26c,0x270,0x25c,0x274,0x7ff7199f70f8,0x7ff7199f7104,0x7ff7199f7110
                                5⤵
                                  PID:2200
                          • C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe
                            "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"
                            2⤵
                              PID:8
                            • C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe
                              "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"
                              2⤵
                                PID:2104
                              • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                                "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkRCMTAzNTUtMjVFQS00N0M4LTgzNEYtRDJCNTU4NTJDNDhCfSIgdXNlcmlkPSJ7NjlCNEZDRTYtMzhGOC00NUI0LUEzMjYtNDk5MkQyNkRCNjQ5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc0M0RCMDNBLTM5NDItNEJFMS1CNUYwLUQ5M0FEOTZFNUFEQX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTIwLjAuNjA5OS4xMzAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9ImVuLUdCIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTUiIGlpZD0ie0NBRUM2REQzLUNBOUEtRjNGOS0yRkU1LUU2NTYxQkE0QzNFQX0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2Fja2JpcWhiMmRxM3ZjejVmenY3Yml2dnBqNXFfMTIwLjAuNjA5OS4xMzAvMTIwLjAuNjA5OS4xMzBfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjExMTQ3OTg1NiIgdG90YWw9IjExMTQ3OTg1NiIgZG93bmxvYWRfdGltZV9tcz0iMTM3OTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjU5NCIgZG93bmxvYWRfdGltZV9tcz0iMTQ4MTIiIGRvd25sb2FkZWQ9IjExMTQ3OTg1NiIgdG90YWw9IjExMTQ3OTg1NiIgaW5zdGFsbF90aW1lX21zPSIyODk4NCIvPjwvYXBwPjwvcmVxdWVzdD4
                                2⤵
                                  PID:2860
                              • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                                "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies registry class
                                PID:3540
                              • C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe
                                "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe" -Embedding
                                1⤵
                                  PID:4156

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdate.exe

                                  Filesize

                                  158KB

                                  MD5

                                  bfb045ceef93ef6ab1cef922a95a630e

                                  SHA1

                                  4a89fc0aa79757f4986b83f15b8780285db86fb6

                                  SHA256

                                  1f6b69d11a3066e21c40002a25986c44e24a66f023a40e5f49eecaea33f5576d

                                  SHA512

                                  9c1bfa88b5b5533ede94158fa3169b9e0458f1ceae04dae0e74f4c23a899ce27d9109bd298a2053fb698e2ed403f51a9b828ee9fa9d66b54a18cd0d969edc194

                                • C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_ar.dll

                                  Filesize

                                  41KB

                                  MD5

                                  adae3c47edd1bd2e078f46e7dd448ff9

                                  SHA1

                                  e05b32b580286d45a9a3011cb209deed6fe964fe

                                  SHA256

                                  41a395dc1c9b6e10a32e39fc9bcc3c45611b30723c5a895ab46bd2abdac31d3a

                                  SHA512

                                  c05774d97c45fad2821526f852035954fd6dd9f1320d958657201d3fb378f763b8ff075848e7513c9872405dbabb656895193efda26a2a7587b0ba014a9abe38

                                • C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_de.dll

                                  Filesize

                                  45KB

                                  MD5

                                  35c9a26ea3cc527cf812edf6b20624d7

                                  SHA1

                                  dec5b58d039cfe7992a9fa58cdd80a2b03128054

                                  SHA256

                                  0f9022abd367d05db56b0b6158d4afa8b938ea78c87d86259544bdba83019af1

                                  SHA512

                                  40b5c2c7b56f035fbd2aa28f0fa169b864279dd169f1e019a8454a8a03ef97b6cdb6a82de065a110c75c8c541c973085e7a7d30d6d3741840b89214f438919cb

                                • C:\Program Files\Common Files\System\symsrv.dll

                                  Filesize

                                  67KB

                                  MD5

                                  7574cf2c64f35161ab1292e2f532aabf

                                  SHA1

                                  14ba3fa927a06224dfe587014299e834def4644f

                                  SHA256

                                  de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

                                  SHA512

                                  4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

                                • C:\Program Files\Common Files\System\symsrv.dll.000

                                  Filesize

                                  175B

                                  MD5

                                  1130c911bf5db4b8f7cf9b6f4b457623

                                  SHA1

                                  48e734c4bc1a8b5399bff4954e54b268bde9d54c

                                  SHA256

                                  eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

                                  SHA512

                                  94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

                                • C:\Program Files\Google\Chrome\Application\120.0.6099.130\Installer\setup.exe

                                  Filesize

                                  65KB

                                  MD5

                                  6451987962fd7da47876fc120f38d754

                                  SHA1

                                  ca957b05f399816216d9f8995626595b7eb9fd45

                                  SHA256

                                  02b0b6b897a9b658fca08944756e6bccefc7244995cb8ab9cdd445b8253d0d9b

                                  SHA512

                                  5ec8734029b739302f2563f9d80929041fa57878bd587b1afde0fc90cc5eb6280e4e24a4fb0d7b0f33771e8ef5969f9417a3f2f264e1e6e355d8562e91a29ad3

                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\20231231073036.pma

                                  Filesize

                                  2KB

                                  MD5

                                  aec2b935af93f5048a4508bdb8fdbc2e

                                  SHA1

                                  fdd8a0ea30f7841b77ade837c52cbc4f2058471e

                                  SHA256

                                  ab53d0c3d1824c31a116b32d6d0ac7ca2bf6b0758d839866dc77392d2dbbdb55

                                  SHA512

                                  984722374d55f813a3fbba62eb0382d8b89e3317b53df081b6d5ad516f28da3b342d0360a020522478dd70df2b32b1864b5c1299ccf3b38d5d3fcdd8f3257d71

                                • C:\Users\Admin\AppData\Local\Temp\A1D26E2\4A961068524.tmp

                                  Filesize

                                  1.3MB

                                  MD5

                                  bfafac25aa1a93972b60e9b36ec5d7f8

                                  SHA1

                                  30514d15342d622ee14e7a5e424ea25989c8fb4d

                                  SHA256

                                  b177f474925a433bc557d749ea0f668972204d7b0728684f467cae2b3b883c07

                                  SHA512

                                  31d3a396bc328008b856368c0d9019e1c24dc5dddaf31c9df5b7f2354349b76bde1be1729238d889037226cd532796775a0646d3e6616da9315f2d23a86a05d6

                                • memory/1316-324-0x0000000010000000-0x0000000010030000-memory.dmp

                                  Filesize

                                  192KB

                                • memory/1316-3-0x0000000010000000-0x0000000010030000-memory.dmp

                                  Filesize

                                  192KB

                                • memory/1316-7-0x0000000000B50000-0x0000000000C9F000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/1316-320-0x0000000076930000-0x0000000076993000-memory.dmp

                                  Filesize

                                  396KB

                                • memory/1316-322-0x0000000076930000-0x0000000076993000-memory.dmp

                                  Filesize

                                  396KB

                                • memory/1316-432-0x0000000010000000-0x0000000010030000-memory.dmp

                                  Filesize

                                  192KB

                                • memory/1316-8-0x0000000000B50000-0x0000000000C9F000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/1316-329-0x0000000010000000-0x0000000010030000-memory.dmp

                                  Filesize

                                  192KB

                                • memory/1316-6-0x0000000000B50000-0x0000000000C9F000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/1316-5-0x0000000000B50000-0x0000000000C9F000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/1316-380-0x0000000010000000-0x0000000010030000-memory.dmp

                                  Filesize

                                  192KB

                                • memory/1316-27-0x0000000000B50000-0x0000000000C9F000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/1316-386-0x0000000076930000-0x0000000076993000-memory.dmp

                                  Filesize

                                  396KB

                                • memory/1316-392-0x0000000010000000-0x0000000010030000-memory.dmp

                                  Filesize

                                  192KB

                                • memory/1432-395-0x0000000073220000-0x0000000073415000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/2104-435-0x00000000007E0000-0x000000000082C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/3640-394-0x0000000073220000-0x0000000073415000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/3640-405-0x0000000073220000-0x0000000073415000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/3640-457-0x0000000073220000-0x0000000073415000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/4644-393-0x0000000074B30000-0x0000000074D25000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/4644-325-0x0000000074B30000-0x0000000074D25000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/4644-456-0x0000000074B30000-0x0000000074D25000-memory.dmp

                                  Filesize

                                  2.0MB