Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    40s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2024, 02:11

General

  • Target

    Schizopod/Nonmakeup101.ps1

  • Size

    53KB

  • MD5

    2e56e126a7f68c9dbb6167bfc1cd26c2

  • SHA1

    e45b4e9dff74f0711968994253b8fcaf39a5f8e3

  • SHA256

    b3fb58fdae2d31784f1b1c4f62b2c20a985789de7cb63b6e4748168aac4fb70a

  • SHA512

    15b0861ae57b05cc8906d8706332797da2152d44f16ba4c89da37fc6ec5753d543e890d898ecda384bcf1cf18894291a94262959dd7f395649e220629a814e3d

  • SSDEEP

    1536:Gz9YtlEnPI/VDPvl1vT47lZs98nds/Z5m3:0beDPtBTEaE2/C

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Schizopod\Nonmakeup101.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:1588
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4540
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1444
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3680
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1988
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3528
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:5064
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3156
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:5396
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:5456
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:5784
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:6064
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4432
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4872
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:5916
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:6016
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4908
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:5144
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:5768
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:1816
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:5644
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:5744
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4132
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3444
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2800
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:5664
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:5764
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4144
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:3144
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4164
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:6124
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1580
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4828
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:2964
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:4048
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3596
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:5944
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1120
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4760
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:6128
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4152
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:5032
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4244
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2640
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2432
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2964
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:316
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:5480

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                          Filesize

                                                                                          471B

                                                                                          MD5

                                                                                          3cb14eabec0b9c9d65916a24297eabbf

                                                                                          SHA1

                                                                                          f77772d3dde902b8adee7393c22c854ad80b67d1

                                                                                          SHA256

                                                                                          92a46255f3672e26e216e557fd5600b2c9867131134a66b4450f24464408a2e5

                                                                                          SHA512

                                                                                          1287e097de2585083f70d7ab0ecda2da98437acc48ac570fb20102769ad531f13900ff47e58d9d3666ffa56c2b405caf0c4328cbfcdf1fc498b1cc2a737aad1c

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                          Filesize

                                                                                          412B

                                                                                          MD5

                                                                                          ddff7af6e8cd3456592c2ed348bfa82b

                                                                                          SHA1

                                                                                          6de6a37d21cc0efcf0900414c6ba10a82f6269e7

                                                                                          SHA256

                                                                                          de6375f54ad3b27cba71883f9fab3e594d8391c811743fe942d42e45479f43a1

                                                                                          SHA512

                                                                                          eb3b82660cf995f12fad444e845bc5ac4ad021832f93f8b102d1160ddb067a8bf1850a57a8ead4b50fb0dfdab6ca9994ffbd62ef7ec75531ac47207381f75e2e

                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          2d54c85dcdabdacc09ebe1407ff7682f

                                                                                          SHA1

                                                                                          f0cc552ee57b41ef3e5d28c04a351c1fcbbed457

                                                                                          SHA256

                                                                                          54c21cdd2706cb9c352f2c8658f9ec23e35de5c165779724fa68664e8b0ebf05

                                                                                          SHA512

                                                                                          825f5af10c7a413153b1f4fa6125254e1763646afe15e88b387be8f623fc9300e561b2f5fd01a078a6e167af7a1c09ad790d4389b4400b9b5fe0c293022b115f

                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xml

                                                                                          Filesize

                                                                                          96B

                                                                                          MD5

                                                                                          84209e171da10686915fe7efcd51552d

                                                                                          SHA1

                                                                                          6bf96e86a533a68eba4d703833de374e18ce6113

                                                                                          SHA256

                                                                                          04d6050009ea3c99cc718ad1c07c5d15268b459fcfb63fcb990bc9761738907b

                                                                                          SHA512

                                                                                          48d2524000911cfb68ef866dedac78ee430d79aa3f4b68399f645dc2066841e6962e11a3362cbcec46680357dcd3e58cfef9994450fed1d8af04df44f76b0dfd

                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gz0cfejm.fcv.ps1

                                                                                          Filesize

                                                                                          60B

                                                                                          MD5

                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                          SHA1

                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                          SHA256

                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                          SHA512

                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                        • memory/1120-183-0x00000000033C0000-0x00000000033C1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/1580-145-0x0000024823910000-0x0000024823930000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/1580-143-0x0000024823950000-0x0000024823970000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/1580-147-0x0000024823F20000-0x0000024823F40000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/2964-230-0x0000000004590000-0x0000000004591000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/3156-41-0x000002CDC9B60000-0x000002CDC9B80000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/3156-37-0x000002CDC9590000-0x000002CDC95B0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/3156-39-0x000002CDC9550000-0x000002CDC9570000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/3444-124-0x0000021D48610000-0x0000021D49F3F000-memory.dmp

                                                                                          Filesize

                                                                                          25.2MB

                                                                                        • memory/3444-110-0x000002254B460000-0x000002254B480000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/3444-112-0x000002254B420000-0x000002254B440000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/3444-114-0x000002254B820000-0x000002254B840000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/3528-30-0x0000000004510000-0x0000000004511000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/4048-169-0x00000225CFB00000-0x00000225CFB20000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4048-173-0x00000225CFF40000-0x00000225CFF60000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4048-166-0x00000225CFB40000-0x00000225CFB60000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4152-207-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/4164-136-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/4244-218-0x00000205C2EF0000-0x00000205C2F10000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4244-215-0x00000205C2F30000-0x00000205C2F50000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4244-220-0x00000205C3500000-0x00000205C3520000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4828-158-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/4872-61-0x000002A7E9D70000-0x000002A7E9D90000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4872-64-0x000002A7E9D30000-0x000002A7E9D50000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/4872-65-0x000002A7EA1F0000-0x000002A7EA210000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/5012-19-0x000001E46B5D0000-0x000001E46B5E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                        • memory/5012-9-0x000001E46E740000-0x000001E46E762000-memory.dmp

                                                                                          Filesize

                                                                                          136KB

                                                                                        • memory/5012-22-0x00007FFCE85B0000-0x00007FFCE9071000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                        • memory/5012-21-0x000001E46E9E0000-0x000001E46E9E4000-memory.dmp

                                                                                          Filesize

                                                                                          16KB

                                                                                        • memory/5012-24-0x000001E46B5D0000-0x000001E46B5E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                        • memory/5012-10-0x00007FFCE85B0000-0x00007FFCE9071000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                        • memory/5012-20-0x000001E46B5D0000-0x000001E46B5E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                        • memory/5012-23-0x000001E46B5D0000-0x000001E46B5E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                        • memory/5012-13-0x000001E46B5D0000-0x000001E46B5E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                        • memory/5012-25-0x00007FFCE85B0000-0x00007FFCE9071000-memory.dmp

                                                                                          Filesize

                                                                                          10.8MB

                                                                                        • memory/5012-11-0x000001E46B5D0000-0x000001E46B5E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                        • memory/5012-12-0x000001E46B5D0000-0x000001E46B5E0000-memory.dmp

                                                                                          Filesize

                                                                                          64KB

                                                                                        • memory/5480-241-0x000001B6D1550000-0x000001B6D1570000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/5480-239-0x000001B6D1130000-0x000001B6D1150000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/5480-237-0x000001B6D1170000-0x000001B6D1190000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/5644-100-0x000001D444C30000-0x000001D44655F000-memory.dmp

                                                                                          Filesize

                                                                                          25.2MB

                                                                                        • memory/5644-91-0x000001DC47E40000-0x000001DC47E60000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/5644-88-0x000001DC47830000-0x000001DC47850000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/5644-86-0x000001DC47870000-0x000001DC47890000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/5744-103-0x0000000003720000-0x0000000003721000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/5764-128-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/5768-78-0x0000000002F20000-0x0000000002F21000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/6064-54-0x0000000004200000-0x0000000004201000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                        • memory/6128-195-0x000002972C1C0000-0x000002972C1E0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/6128-193-0x000002972BBB0000-0x000002972BBD0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                        • memory/6128-190-0x000002972BE00000-0x000002972BE20000-memory.dmp

                                                                                          Filesize

                                                                                          128KB