Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 14:51

General

  • Target

    2FastBetVN.exe

  • Size

    151KB

  • MD5

    3fbc8e17cb9da2415668bcc9c22f88b0

  • SHA1

    66879710e62797c06013c7ca924432e3295975e7

  • SHA256

    fdb18d128decf596a3670a3407e9afb6c0320daa40f5e2ebc9bacb94b0d755b6

  • SHA512

    0e27c3671709bac901cd669de232580b9a91fc9c6f68b837fbd2ceb5c2f8901c6fd3785255669563ed457ca2000975bc6b461d12939ab7e21d3de700720ec97c

  • SSDEEP

    3072:xyqBXv8zjxf5GWp1icKAArDZz4N9GhbkrNEk1uN:vu7p0yN90QED

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 4 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 31 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies Control Panel 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2FastBetVN.exe
    "C:\Users\Admin\AppData\Local\Temp\2FastBetVN.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c "destroy.bat"
      2⤵
      • Drops file in Drivers directory
      • Manipulates Digital Signatures
      • Drops desktop.ini file(s)
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Modifies termsrv.dll
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:1900
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
    1⤵
      PID:956
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4504
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
      1⤵
        PID:4224
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2472
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4224
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4228
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3860
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
              1⤵
                PID:2928
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                1⤵
                  PID:4924
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                  1⤵
                    PID:1308
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                    1⤵
                      PID:5044
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                      1⤵
                        PID:4968
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                        1⤵
                          PID:4480
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                          1⤵
                            PID:2888
                          • C:\Windows\system32\rundll32.exe
                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                            1⤵
                              PID:2708
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                              1⤵
                                PID:2852
                              • C:\Windows\system32\rundll32.exe
                                "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                1⤵
                                  PID:3112
                                • C:\Windows\system32\rundll32.exe
                                  "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                  1⤵
                                    PID:4376
                                  • C:\Windows\system32\rundll32.exe
                                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                    1⤵
                                      PID:1700
                                    • C:\Windows\system32\rundll32.exe
                                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                      1⤵
                                        PID:1520
                                      • C:\Windows\system32\rundll32.exe
                                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                        1⤵
                                        • Blocklisted process makes network request
                                        • Checks computer location settings
                                        • Checks system information in the registry
                                        • Enumerates system info in registry
                                        • Modifies Control Panel
                                        • Modifies Internet Explorer settings
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4228
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3896

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\CGINX0ZY\microsoft.windows[1].xml

                                        Filesize

                                        96B

                                        MD5

                                        682dbc2e8073203aa0a65f0a2cd20a1f

                                        SHA1

                                        bac81eade01e588bac83803a78227ba1a6a2a5d6

                                        SHA256

                                        6164e1488aa5621a3ff95fafa61cc123a1353fc5011e2bc5a165c93019c05248

                                        SHA512

                                        003ea39dc8af6894c6848d3d1fcc2c9f4f536821d5f0323ebce6af8ff8034f60ee74dd71c4068cad37f5bccc08d5d3a0fa1b5fa7a895c86ce9d2ba7a9e4ff79d

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}

                                        Filesize

                                        36KB

                                        MD5

                                        bad093419be1135cfe9694ea77088c78

                                        SHA1

                                        76204c7ca72cf666add9c9931389d635c82e8af0

                                        SHA256

                                        136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c

                                        SHA512

                                        3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0668cfdb-00be-4ad0-996d-dc35724c5634}\apps.csg

                                        Filesize

                                        444B

                                        MD5

                                        5475132f1c603298967f332dc9ffb864

                                        SHA1

                                        4749174f29f34c7d75979c25f31d79774a49ea46

                                        SHA256

                                        0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

                                        SHA512

                                        54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0668cfdb-00be-4ad0-996d-dc35724c5634}\apps.schema

                                        Filesize

                                        150B

                                        MD5

                                        1659677c45c49a78f33551da43494005

                                        SHA1

                                        ae588ef3c9ea7839be032ab4323e04bc260d9387

                                        SHA256

                                        5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

                                        SHA512

                                        740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e39ded7a-aa1c-41d7-a561-1d7c13064cf4}\appsconversions.txt

                                        Filesize

                                        1.4MB

                                        MD5

                                        2bef0e21ceb249ffb5f123c1e5bd0292

                                        SHA1

                                        86877a464a0739114e45242b9d427e368ebcc02c

                                        SHA256

                                        8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

                                        SHA512

                                        f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e39ded7a-aa1c-41d7-a561-1d7c13064cf4}\appsglobals.txt

                                        Filesize

                                        343KB

                                        MD5

                                        931b27b3ec2c5e9f29439fba87ec0dc9

                                        SHA1

                                        dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

                                        SHA256

                                        541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

                                        SHA512

                                        4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e39ded7a-aa1c-41d7-a561-1d7c13064cf4}\appssynonyms.txt

                                        Filesize

                                        237KB

                                        MD5

                                        06a69ad411292eca66697dc17898e653

                                        SHA1

                                        fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

                                        SHA256

                                        2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

                                        SHA512

                                        ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e5fc99c3-a419-4a7d-befb-0ca209ab0729}\settings.csg

                                        Filesize

                                        454B

                                        MD5

                                        411d53fc8e09fb59163f038ee9257141

                                        SHA1

                                        cb67574c7872f684e586b438d55cab7144b5303d

                                        SHA256

                                        1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48

                                        SHA512

                                        67b342c434d8f3a8b9e9ac8a4cbd4c3ef83ddfc450fe7e6ad6f375dba9c8a4977a15a08b49f5ad7644fbde092396e6da08865aa54d399836e5444cb177a33444

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e5fc99c3-a419-4a7d-befb-0ca209ab0729}\settings.schema

                                        Filesize

                                        162B

                                        MD5

                                        ac68ac6bffd26dbea6b7dbd00a19a3dd

                                        SHA1

                                        a3d70e56249db0b4cc92ba0d1fc46feb540bc83f

                                        SHA256

                                        d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031

                                        SHA512

                                        6c3fcce2f73e9a5fc6094f16707109d03171d4a7252cf3cb63618243dbb25adb40045de9be27cad7932fd98205bdaf0f557d282b2ba92118bba26efcf1cd2a02

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e5fc99c3-a419-4a7d-befb-0ca209ab0729}\settingsconversions.txt

                                        Filesize

                                        520KB

                                        MD5

                                        721134982ff8900b0e68a9c5f6f71668

                                        SHA1

                                        fca3e3eb8f49dd8376954b499c20a7b7cad6b0f1

                                        SHA256

                                        2541db95c321472c4cb91864cdfa2f1ed0f0069ac7f9cec86e10822283985c13

                                        SHA512

                                        5d1c305b938e52a82216b3d0cee0eead2dc793fac35da288061942b2bd281fb48c7bd18f5fdaa93a88aa42c88b2a0cce1f0513effb193782670d46164d277a59

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e5fc99c3-a419-4a7d-befb-0ca209ab0729}\settingsglobals.txt

                                        Filesize

                                        43KB

                                        MD5

                                        bbeadc734ad391f67be0c31d5b9cbf7b

                                        SHA1

                                        8fd5391c482bfbca429aec17da69b2ca00ed81ae

                                        SHA256

                                        218042bc243a1426dd018d484f9122662dba2c44a0594c37ffb3b3d1d0fb454a

                                        SHA512

                                        a046600c7ad6c30b003a1ac33841913d7d316606f636c747a0989425697457b4bc78da6607edd4b8510bd4e9b86011b5bd108a5590a2ba722d44e51633ed784f

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e5fc99c3-a419-4a7d-befb-0ca209ab0729}\settingssynonyms.txt

                                        Filesize

                                        101KB

                                        MD5

                                        003ece80b3820c43eb83878928b8469d

                                        SHA1

                                        790af92ff0eb53a926412e16113c5d35421c0f42

                                        SHA256

                                        12d00eee26e5f261931e51cfa56e04c54405eb32d1c4b440e35bd2b48d5fcf07

                                        SHA512

                                        b2d6d9b843124f5e8e06a35a89e34228af9e05cbfa2ae1fe3d9bc4ddbebda4d279ce52a99066f2148817a498950e37a7f0b73fe477c0c6c39c7016aa647079a5

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133501495222490693.txt

                                        Filesize

                                        72KB

                                        MD5

                                        5b4b9d0df8b6dfd821c5d714018057d2

                                        SHA1

                                        737572ed9a2e31b9c70be6b89a69c1cef3b9fa5a

                                        SHA256

                                        c8fe9454e3257e33e2aa62872f4e7686f19e5ef84f161fdafb59e364e764e069

                                        SHA512

                                        dc55427a58a5a84f3daed54eec79f47ad6278ca640ddb39d1c346006b2455347a94d41b7184afda1e9f34c9d848f478a1b55a70594afb5f500458bac4ed1ec29

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

                                        Filesize

                                        9KB

                                        MD5

                                        008372b1269023bc0627d0e6548a2d45

                                        SHA1

                                        02ba00286d5864f61ab36a9b2adca14d5a7fb515

                                        SHA256

                                        a21bf76dd9101a145c3a7fc3736b739bcbc0ff43662435fb28f57241ce1bcc3f

                                        SHA512

                                        86abbbbfcdfd54400d667611ac249b96f0d303ad9bcc093b71465e5027a5cc7f8783daa6d47f6b35d0e3e851dc9778af6d836e046213ff729cf29850ad2f836d

                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\destroy.bat

                                        Filesize

                                        164B

                                        MD5

                                        b45a7c4a06347c272adc225a43e53b04

                                        SHA1

                                        cc67480527e18c82b4896354d285fa3d6ba1000e

                                        SHA256

                                        66b39e56ce0aa29842b178337342195f4ab4e5a8d1cf7d800710b467e447f227

                                        SHA512

                                        c88230442de4710a303f513a3aaf3647611432fb6e263daa5e875a8501ca931907e2b1d1139b45b3d0a804ae038a44f6e08bd317dacaf8e6f0e20ac47ca4a30a

                                      • memory/1896-49-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-47-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-54-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-55-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-56-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-57-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-58-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-59-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-60-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-61-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-62-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-63-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-64-0x00000218A2030000-0x00000218A2031000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-66-0x00000218A2140000-0x00000218A2141000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-65-0x00000218A2030000-0x00000218A2031000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-68-0x00000218A20A0000-0x00000218A20A1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-67-0x00000218A20A0000-0x00000218A20A1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-3-0x0000021899B80000-0x0000021899B90000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1896-19-0x0000021899C80000-0x0000021899C90000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1896-38-0x00000218A1EB0000-0x00000218A1EB1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-52-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-53-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-50-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-48-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-46-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-51-0x00000218A2020000-0x00000218A2021000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-45-0x00000218A2000000-0x00000218A2001000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-44-0x00000218A2000000-0x00000218A2001000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-43-0x00000218A2000000-0x00000218A2001000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-42-0x00000218A1FF0000-0x00000218A1FF1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1896-40-0x00000218A1FF0000-0x00000218A1FF1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4504-83-0x00000210AE2E0000-0x00000210AE300000-memory.dmp

                                        Filesize

                                        128KB

                                      • memory/4504-81-0x00000210ADF50000-0x00000210ADF70000-memory.dmp

                                        Filesize

                                        128KB

                                      • memory/4504-77-0x00000210ADF90000-0x00000210ADFB0000-memory.dmp

                                        Filesize

                                        128KB