Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 02:53

General

  • Target

    fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe

  • Size

    1.9MB

  • MD5

    541a9d3031657ebc794dc43a70511384

  • SHA1

    1c18826b93532c58a2a20ac1061e4309e7441867

  • SHA256

    fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533

  • SHA512

    fd3df8395904bad5ab23ebc1ac21febac8a55ebfe390039cba6b35d47c41963e91cc17f6c2144b024dc1d100528beec5ab6ee337b8181fb7c6630c6fef5e3c22

  • SSDEEP

    24576:s7USn+9Co5+54pIbtNSPouMVMOU93aBOR/UCtN0FSrSOdJw1EgfqBhR5OMqj6oxq:8qIZuMCso1U6Tda1lAeMsynjCM5x6

Malware Config

Signatures

  • Detect ZGRat V1 3 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects executables packed with unregistered version of .NET Reactor 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe
    "C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2908
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2116
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2280
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1236
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\fr-FR\sppsvc.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2268
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\System.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\csrss.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\taskhost.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2320
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1876
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t5YQAc7xk1.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2980
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          3⤵
            PID:2804
          • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.exe
            "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2972
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\fr-FR\sppsvc.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2700
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\fr-FR\sppsvc.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2464
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\fr-FR\sppsvc.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3012
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\Branding\System.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1204
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Branding\System.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1868
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\Branding\System.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2812
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\csrss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2856
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\it-IT\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3068
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\it-IT\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2672
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\taskhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2008
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\es-ES\taskhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2736
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Windows\es-ES\taskhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1652
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2680
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:676
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1332
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1484
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2804
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1724

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.exe

        Filesize

        768KB

        MD5

        fdeadb417aa329cf09c8df606c55e9ae

        SHA1

        495afbb95e965462a61dd85ca3bcd5226dd9873c

        SHA256

        ec79df375bc789735489bc1cda623b9f4ad8a78aa3983874a505ef3d64496d72

        SHA512

        6cf3471e2f073730bf4db0db77ba7289469cab43e0c092278a34e5e2a5caed0a45cfd2fffda970ee5e9f9c1c1f87ef2f47e666c55faa059b32155b85e8c7371d

      • C:\Users\Admin\AppData\Local\Temp\t5YQAc7xk1.bat

        Filesize

        259B

        MD5

        5656e1fcaa92999f94f4677445d75a0e

        SHA1

        06e1ca6e60ae019fe7eff07cbb05479fcc009600

        SHA256

        004779f636871bff8fcd32b0d08917b8677309ca07945020cbdd1ab3c4af2bdc

        SHA512

        90c08d04e18a5d955c80c65cc462857be06131a6dda29cb263f8c63fdbc322307a9847a233386c3e90d22beec25ddf7e07f1c9b23652ce7ffc28f15bf4babc9b

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

        Filesize

        7KB

        MD5

        4ea9faa05fde44ff53513a678e90b49f

        SHA1

        7f480524c53057843ac1bdf188b299164fd63dae

        SHA256

        18b5dc7afe413ca8535cd7ffe16b28df18869940c0bdf0538697ba1559ef9711

        SHA512

        7ae6e1f0c4f8d18f42b23627996e04009864a6cb0793bd046e852d58f98c5a0deef6ca2c3de4ccc271385236f57f2aee9eb259a62ec891d33e4ed4f305302360

      • C:\Windows\PolicyDefinitions\fr-FR\sppsvc.exe

        Filesize

        1.9MB

        MD5

        541a9d3031657ebc794dc43a70511384

        SHA1

        1c18826b93532c58a2a20ac1061e4309e7441867

        SHA256

        fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533

        SHA512

        fd3df8395904bad5ab23ebc1ac21febac8a55ebfe390039cba6b35d47c41963e91cc17f6c2144b024dc1d100528beec5ab6ee337b8181fb7c6630c6fef5e3c22

      • memory/856-158-0x0000000002940000-0x00000000029C0000-memory.dmp

        Filesize

        512KB

      • memory/856-157-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/856-159-0x0000000002940000-0x00000000029C0000-memory.dmp

        Filesize

        512KB

      • memory/856-164-0x0000000002940000-0x00000000029C0000-memory.dmp

        Filesize

        512KB

      • memory/1056-167-0x00000000029B0000-0x0000000002A30000-memory.dmp

        Filesize

        512KB

      • memory/1056-166-0x00000000029B0000-0x0000000002A30000-memory.dmp

        Filesize

        512KB

      • memory/1056-165-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1156-169-0x0000000002240000-0x00000000022C0000-memory.dmp

        Filesize

        512KB

      • memory/1156-168-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1156-171-0x0000000002240000-0x00000000022C0000-memory.dmp

        Filesize

        512KB

      • memory/1156-170-0x0000000002240000-0x00000000022C0000-memory.dmp

        Filesize

        512KB

      • memory/1236-151-0x0000000002640000-0x00000000026C0000-memory.dmp

        Filesize

        512KB

      • memory/1236-140-0x0000000002640000-0x00000000026C0000-memory.dmp

        Filesize

        512KB

      • memory/1236-139-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1236-137-0x0000000002640000-0x00000000026C0000-memory.dmp

        Filesize

        512KB

      • memory/1236-136-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1364-147-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1364-149-0x0000000002520000-0x00000000025A0000-memory.dmp

        Filesize

        512KB

      • memory/1364-153-0x0000000002520000-0x00000000025A0000-memory.dmp

        Filesize

        512KB

      • memory/1364-74-0x0000000002510000-0x0000000002518000-memory.dmp

        Filesize

        32KB

      • memory/1364-152-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1364-156-0x0000000002520000-0x00000000025A0000-memory.dmp

        Filesize

        512KB

      • memory/1508-172-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1508-173-0x0000000002920000-0x00000000029A0000-memory.dmp

        Filesize

        512KB

      • memory/1508-174-0x0000000002920000-0x00000000029A0000-memory.dmp

        Filesize

        512KB

      • memory/1936-24-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

        Filesize

        9.9MB

      • memory/1936-18-0x00000000777C0000-0x00000000777C1000-memory.dmp

        Filesize

        4KB

      • memory/1936-1-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

        Filesize

        9.9MB

      • memory/1936-2-0x000000001B100000-0x000000001B180000-memory.dmp

        Filesize

        512KB

      • memory/1936-138-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

        Filesize

        9.9MB

      • memory/1936-39-0x000000001B100000-0x000000001B180000-memory.dmp

        Filesize

        512KB

      • memory/1936-3-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/1936-4-0x000000001B100000-0x000000001B180000-memory.dmp

        Filesize

        512KB

      • memory/1936-5-0x0000000077800000-0x0000000077801000-memory.dmp

        Filesize

        4KB

      • memory/1936-6-0x000000001B100000-0x000000001B180000-memory.dmp

        Filesize

        512KB

      • memory/1936-38-0x000000001B100000-0x000000001B180000-memory.dmp

        Filesize

        512KB

      • memory/1936-8-0x00000000005F0000-0x00000000005FE000-memory.dmp

        Filesize

        56KB

      • memory/1936-37-0x000000001B100000-0x000000001B180000-memory.dmp

        Filesize

        512KB

      • memory/1936-36-0x000000001B100000-0x000000001B180000-memory.dmp

        Filesize

        512KB

      • memory/1936-25-0x00000000777B0000-0x00000000777B1000-memory.dmp

        Filesize

        4KB

      • memory/1936-9-0x00000000777F0000-0x00000000777F1000-memory.dmp

        Filesize

        4KB

      • memory/1936-11-0x0000000000620000-0x000000000063C000-memory.dmp

        Filesize

        112KB

      • memory/1936-0-0x0000000000300000-0x00000000004E6000-memory.dmp

        Filesize

        1.9MB

      • memory/1936-22-0x0000000000860000-0x000000000086C000-memory.dmp

        Filesize

        48KB

      • memory/1936-13-0x00000000006C0000-0x00000000006D8000-memory.dmp

        Filesize

        96KB

      • memory/1936-20-0x0000000000610000-0x0000000000618000-memory.dmp

        Filesize

        32KB

      • memory/1936-17-0x00000000777D0000-0x00000000777D1000-memory.dmp

        Filesize

        4KB

      • memory/1936-14-0x00000000777E0000-0x00000000777E1000-memory.dmp

        Filesize

        4KB

      • memory/1936-16-0x0000000000600000-0x000000000060C000-memory.dmp

        Filesize

        48KB

      • memory/2116-143-0x00000000026C0000-0x0000000002740000-memory.dmp

        Filesize

        512KB

      • memory/2116-148-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/2116-160-0x00000000026C0000-0x0000000002740000-memory.dmp

        Filesize

        512KB

      • memory/2116-141-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/2116-142-0x00000000026C0000-0x0000000002740000-memory.dmp

        Filesize

        512KB

      • memory/2268-163-0x00000000024E0000-0x0000000002560000-memory.dmp

        Filesize

        512KB

      • memory/2268-161-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/2268-162-0x00000000024E0000-0x0000000002560000-memory.dmp

        Filesize

        512KB

      • memory/2280-154-0x0000000002664000-0x0000000002667000-memory.dmp

        Filesize

        12KB

      • memory/2280-150-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/2908-146-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/2908-144-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmp

        Filesize

        9.6MB

      • memory/2908-69-0x000000001B280000-0x000000001B562000-memory.dmp

        Filesize

        2.9MB

      • memory/2908-145-0x0000000002850000-0x00000000028D0000-memory.dmp

        Filesize

        512KB

      • memory/2928-155-0x00000000028C0000-0x0000000002940000-memory.dmp

        Filesize

        512KB