Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/06/2024, 04:57

240612-flpr1a1flp 6

12/06/2024, 04:52

240612-fhvtva1eqd 6

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 04:52

General

  • Target

    PingPlotter Professional 5.24.3.8913/pingplotter_install.exe

  • Size

    21.4MB

  • MD5

    ae2015bc36bb8a0b872d049430c622c2

  • SHA1

    c11db0f26d3554dea55b601eecdc50f90eae785d

  • SHA256

    3586e0620442b8dfe2ae80f14dd389c224a7b9db7e6b9b29779a5b3d28e4a47f

  • SHA512

    85c3b9380c2a803bb2f3f64a667bc062f0ee786f9bc5d50f6ce5157055eae20c76f6c6ae3d0ead0a89f011925dd7bb8097d5c6014c2fb5b077cf5ff734cceaf0

  • SSDEEP

    393216:SeHSB8FeRF1NDgVEoZM9m5boLMMzgO+8+X7gj/pIBibcqBKOCCtbP:YzXay9UoL5+RgjLRgEP

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\PingPlotter Professional 5.24.3.8913\pingplotter_install.exe
    "C:\Users\Admin\AppData\Local\Temp\PingPlotter Professional 5.24.3.8913\pingplotter_install.exe"
    1⤵
    • Enumerates connected drives
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2724
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CD4260307A46ACE0967FBF6020BC780E C
      2⤵
      • Loads dropped DLL
      PID:1948
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3112
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9D1F35A8187679CFA452B8AC6F18A8F4
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2620
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DC1D9B417077D784F70220BE90416E41 E Global\MSI0000
        2⤵
        • Drops file in System32 directory
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Windows\SysWOW64\cmd.exe
          /C "C:\Users\Admin\AppData\Local\Temp\{FE7D9469-69FF-4AD0-A0FA-666CF8090897}.bat"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            4⤵
              PID:2020
          • C:\Windows\SysWOW64\cmd.exe
            /C "C:\Users\Admin\AppData\Local\Temp\{FE7D9469-69FF-4AD0-A0FA-666CF8090897}.bat"
            3⤵
              PID:1132
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" /queue:1
              3⤵
              • Drops file in Windows directory
              PID:1712
          • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
            "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver initializeprofile quiet
            2⤵
            • Executes dropped EXE
            PID:5044
          • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
            "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver quiet
            2⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            PID:4904
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:2376
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
          1⤵
            PID:4896

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Config.Msi\e58dc52.rbs

            Filesize

            2.1MB

            MD5

            51ed69178e2fdb90e1e101c7fef44982

            SHA1

            581cc6a5735e94a431680d73853762129b95d7c9

            SHA256

            d99be018e924eeb40c9ca4c51a38b0c58b897b737b533ed0dcc89d9cc93db62d

            SHA512

            5ba82b862cf56757b2009e513b62be5b7bc16afc3202ae6f1f66c318009481eaa95c5664f6a442fe8cf68809ef03f091db97f007a0bfdcf557fa27f4dea2216c

          • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.DataGrid.Contrib.Wpf.dll

            Filesize

            87KB

            MD5

            9c43eb18df357b00aaf31b6684e57a53

            SHA1

            6de6fc5c23b5ef38eb2faab1eb643c3161c2e9f6

            SHA256

            abf2ec51aff791bee7580e77502a90b28aa034d2e729580e0d2b10d7ee296fd6

            SHA512

            fea50d9884aef63e24546d0947608fee8fb3aad6b0f8b5a02fdf5fead5564c2d8f16828fae1c182f1350b209a8a9b2e99201822957c36787b6ff36d266412309

          • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Docking.Wpf.dll

            Filesize

            677KB

            MD5

            b9d27fbdd161b1879aa1b5bf390b8114

            SHA1

            1e9ffc3fcefc25581fd726087c74d257c713ffe4

            SHA256

            3866414e85e128dd761a894b63befed29fded32788ab79087d0abc79335f17a4

            SHA512

            4af0057663f74f65af501ec45bed8cc75e225395b1acbd318220cd97eb28123b3b7290c34b865129edc20255c6876c58c25308ae1a458a97f5df285f5a2444c6

          • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Editors.Wpf.dll

            Filesize

            929KB

            MD5

            6f0e2870c72222d5989e9842d7d9e275

            SHA1

            9a847f1d5efe181c945c60bcfeeb43132db3f599

            SHA256

            b637f6e4c87ac32276f92c609ee71bb3d482b36d5516e383e5c52d8f615359e8

            SHA512

            ff99918d8a8510d70d250695a583deb91953f6db2abf2a71069a2d67932532977529d3a50ec012cd4547a03601cf8f5367592187768fe4d8aa5a80d8dacfda0d

          • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.PropertyGrid.Wpf.dll

            Filesize

            315KB

            MD5

            3e50933e28b0ac08f7158e3a783f6bf4

            SHA1

            2178728de734670785b749499e4cfda7e1e30f60

            SHA256

            7d0ee0f0aad53788758a43ccf295cad4b8e6afae6815f2a2800033b29b81c14a

            SHA512

            3324d40fdc9a82915b8323f5386d00361bea8ae42aa79fc85b4d9d95a087fbadfc557d9f77e34938ef4fdc8b04d0e6a9f24bbfca6569d981cf404626fb2eb7f6

          • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Shared.Wpf.dll

            Filesize

            1.9MB

            MD5

            674447f18caace5e1163fb227e4cf08d

            SHA1

            62082108201e8be712cd52806a66503cf51fe714

            SHA256

            56dfde9007145d5f6ed21730ecbb5ac04e7c6bc1370fb317acb0e29bffaf5c84

            SHA512

            89fcdc36bd040a554a3bf8be205541914a00e0eed741eed066831d7564fa0f2ede717fb21d1e85e9503d9d262145d2fef837e37ed40087bb7386159fa5411bb8

          • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.SyntaxEditor.Wpf.dll

            Filesize

            1.1MB

            MD5

            855914201fde2285b71d87c05c4bbcc2

            SHA1

            8bc1bdbb97c2775c0399e9d0e90a036f41357a4c

            SHA256

            580a06e4ff57218280a92877d2b5def390b563c86a16366882cfee5d30951bd6

            SHA512

            7040fcb1fa29171f10e9a6400deae3283a078899eb21c969d9fde51136ab5002d2cc95ef9b37ea1647fd28c18df1f1776bd80d12b16703a9b15f2776d97b7fbb

          • C:\Program Files (x86)\PingPlotter 5\CoreLib.dll

            Filesize

            2.2MB

            MD5

            4f79b56c4bebf4683f731c2fa68126ce

            SHA1

            be502d11260c83f3bdb67279f796b137094248b6

            SHA256

            28130a2c33fd8ac4a915bd2a695b1160e61ad179136860675b42bbebc878bb63

            SHA512

            3384c07d2378e87d9e7e85f5db6af6bbfe804b559057339b04fda64e744344255da4d309a75efed9ec3246afbb852d4b4dde9baa7d2a783230f25a56d5f6294f

          • C:\Program Files (x86)\PingPlotter 5\NGraphics.Net.dll

            Filesize

            24KB

            MD5

            50f77484e5ebbab4178d226457277f61

            SHA1

            f9ce26a5dac69bc620481e76ff4bcaa44610b4f1

            SHA256

            76a4ee07ad63c27d6d95b9e0cc9a903563514e9b8fb51744646a19e00c3175a5

            SHA512

            f094291b6097608443d168d7cc5cd6a288f98f6bdb418e22d6f606ea2f54a6c6c166f13fedd827a79e8812d598e4fca1d59f50af17264f80e8dd3621856c77da

          • C:\Program Files (x86)\PingPlotter 5\NGraphics.dll

            Filesize

            100KB

            MD5

            36896e5b8ff559857c870c8d60470d79

            SHA1

            8abe9941ec44d19b2f079fa66c118d60ecd75141

            SHA256

            57f963ae4825b02214ccae01276708613cdda30d74c50289972f4a16bea3d823

            SHA512

            ddbd19c34fe0b38958778cb8e01ec0daf22882a5db774f24d5fbaf3f18938f71f48b55d6b8ed1d31ac31086d416c65f3e410168c891295412a3d67cbbf781793

          • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe

            Filesize

            2.9MB

            MD5

            aea6964efb6bfc8723f85e191c6db9b0

            SHA1

            f213e8ae0088838ae76d9d5841f9e9a2376c78a9

            SHA256

            89a3e51a67ef4684952ab912be4e9fd379b4cf46991d6c17c6e59d34f6ec5eac

            SHA512

            84a8587ccc35cdb2392f2de20a7323bf626bfdef0cc1ba6957273921aa8336086edd58689fac446e342d3ecb9f0a00e7dd2dbb2e5de223a5b6a42e75d845ab8a

          • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe.config

            Filesize

            27KB

            MD5

            928b8e104bc50973bad9150c577aaa64

            SHA1

            33eb7ed6547d26bbb8dbb087a45baf41292d01d2

            SHA256

            b42eb2bb81f89946449c5b27315afec9c87070ac01a6d0d1df91bd9d46702629

            SHA512

            3b8ac3ce5365b27c8156dfb1ccfeff4f8a0e3b10360c2e5639d3516f2b5aa3c2dc524ddbbd6e3d1941ae0d15f8867eb2e19a0df1c31d1872d25f7758c481cff2

          • C:\Program Files (x86)\PingPlotter 5\System.IO.dll

            Filesize

            15KB

            MD5

            ba3845f4986d242d62641e1f6e14caba

            SHA1

            9278fe4d60ed3462835a90c56bf187cadc35ddda

            SHA256

            ab5d0fa375fd11f411293552ffa7b127a62ecc7bef74c5c3a49cad629413e38b

            SHA512

            4ccc206b30208cf1ceef1e7341cf7f28e36f3ba90daff5051ee706841a1f30d49d654399c33b2d336d330789b76e5d3fac39d22d6d45d6d76a3ef643750a70cf

          • C:\Users\Admin\AppData\Local\Temp\MSI804F.tmp

            Filesize

            364KB

            MD5

            ca95f207ec70ba34b46c785f7bcb5570

            SHA1

            25c0d45cb9f94892e2877033d06fe8909e5b9972

            SHA256

            8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

            SHA512

            c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

          • C:\Users\Admin\AppData\Local\Temp\MSI8219.tmp

            Filesize

            561KB

            MD5

            5576bf4d22dc695564e49a68cbc98bc2

            SHA1

            80e0e045162a65d84939e22a821ecbbbde3f31d6

            SHA256

            20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

            SHA512

            4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

          • C:\Users\Admin\AppData\Local\Temp\nsu4642.tmp\DotNetChecker.dll

            Filesize

            84KB

            MD5

            f18364fa5084add86c6e73e457404f18

            SHA1

            6d87c4b9dbf78af88fddf0d4d5febe845c8e4e6a

            SHA256

            39c43d67f546fc898f7406d213b73dcb1bc30fc811ddfa3a02b6b50c29d11f91

            SHA512

            716892492390fe4314f3289286f733d07b8b84de1f5af0676b26e68c0be01808682d35ad2bb9e9491247b7bb5a0ea297a6850e26de9baf88621c789206107db3

          • C:\Users\Admin\AppData\Local\Temp\nsu4642.tmp\System.dll

            Filesize

            11KB

            MD5

            ca332bb753b0775d5e806e236ddcec55

            SHA1

            f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

            SHA256

            df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

            SHA512

            2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

          • C:\Users\Admin\AppData\Local\Temp\ymbrvablvg.tmp

            Filesize

            48B

            MD5

            96a568f9af3d18ebb930331118447946

            SHA1

            30519320aed158e16d1db748d9a9064094593554

            SHA256

            6b824e9f13ee7210ccabdc81e255cf3a390e5b8fcc7b69069349d89de428994e

            SHA512

            b45971c7a6e3ccc4f02227f570bbd7adfbcef7ed4cf39322c272a1ce70fca4f5e048001c44cc17eddf9313770c31fc6728b9e15c56007f03b554a7f529765aab

          • C:\Users\Admin\AppData\Local\Temp\ymbrvablvg.tmp

            Filesize

            48B

            MD5

            2a13a6f38d9299bdfbb1d30a1cea8fde

            SHA1

            8a3d0cd8dcdb24b4d0b40e1de5988b6dc980ed0f

            SHA256

            0f0a878a2dbefb3233c75339d2b5511f0f86e54a230ae037fe3b64a87e193399

            SHA512

            1be095400f54a1cbab1f3f58a485aef463b019a3a55be9b07e2096d30b43676f98b97df3987a97b9a04f5b9a427ad7c26074a0feeec1002a51fb8dd156812cbb

          • C:\Users\Admin\AppData\Local\Temp\{FE7D9469-69FF-4AD0-A0FA-666CF8090897}.bat

            Filesize

            104B

            MD5

            a937e8f48d3a6c808168c5b8ccde386d

            SHA1

            a5c79ce563c6976b75f3037ab544616813b1ac48

            SHA256

            a159304fedf73b8147af1cf80d495f9338db77bbafc822ba176eee02cab7561b

            SHA512

            33cf95a0dc2f57e3e9084eb3ff526c469b2372b64fef0968ac95933f8f6f50b9b7784cfc4aae63d57c02feadb9b0a4845d870f907b41dcfc1a06558fb728a55a

          • C:\Windows\Installer\MSI1027.tmp

            Filesize

            195KB

            MD5

            71c143221c4d2f06e495ee3f9e51a7f0

            SHA1

            44a3aa0ca190243d6f21becbd5b0c5e923426135

            SHA256

            8d245ef042215b0e9211692c7deaef442f4d46bd5323d74aa1bf25d676525bd9

            SHA512

            98a97a4f45cb70eb671ddc3c8d26a9a4c3d34745f0d1b6ee052a2080e1b4b3dac11303eb9a0c8d38e34df624edc28864e52f13e4d79bc16fe9223c5663372445

          • C:\Windows\Installer\MSI11DF.tmp

            Filesize

            196KB

            MD5

            94fa9ff9c26724e0b8ac910c1e7c40aa

            SHA1

            0cf47957200dec349d6b6da432e24165afd590eb

            SHA256

            adae076f90908818d67777c050c5b1b6cc94be728017bab6c638dfc7763d4d09

            SHA512

            becb8229e8ef77a673829c547d2520d6fec94218abf2a21e2948ae5c156bf4a1eb64bfec38653b49902bb31708d9cf770c38f042c1f869d4d4695313b2acfefb

          • C:\Windows\Installer\MSI1200.tmp

            Filesize

            849KB

            MD5

            99dc199a4a390a86f2728f5232a2f9a6

            SHA1

            21b03b2dacbc5e19f3334054703ce53c8ba4a15f

            SHA256

            12b9deeb6e80129593bae1439bcbc491c6f602bfff255f72eba627100a54e2f9

            SHA512

            8ba930b0fb37257bbb0d5ea97bbb581ec7d545b737bdce03a78e713b3ad95a2f4b2b6d101817102763100edfe8e46f4532946a7bd3ac24d2142358ac26ec45db

          • C:\Windows\Installer\MSI1388.tmp

            Filesize

            409KB

            MD5

            e34827bf55cae867e83cc6122d25154a

            SHA1

            e513c23028532a6997692965765e235d42d96efa

            SHA256

            7f8ce80c53a7a4c3cecfbf497ee443538fd126a6e369b9930a3b021db548b55a

            SHA512

            506143a220f58c4236e4736f404c9421b9d5e0caaa21eff950953258ccf783de3534ea702e476acf565719964da6aeaeed787fca2d66c2b8ef5aa51c9b6e38d2

          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

            Filesize

            23.7MB

            MD5

            29235c8b397a0b7cc27d7e81b0279ebd

            SHA1

            bed43f593c3cd174514bb0c1175606bcb353e04e

            SHA256

            af6b1d10b043b53d07a902934665d503ab6ca270dab555e8d0bf3bac6fa7c938

            SHA512

            1082f31d93847b41da5152e535642ca1dd7f9ac221afeeaaf1b35f30387ad05ed4c2e24c9053f0f00c7df72aecbfbb32540e14602b6b28743f6e9bda88f962ef

          • \??\Volume{8ccc3c3f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0f901d05-e6b5-4346-a3f0-c7e8795fba43}_OnDiskSnapshotProp

            Filesize

            6KB

            MD5

            c2d3287eacfe9b2b84a06ecc53a06f3f

            SHA1

            870c4a36229db9de6a60d26a94eea102f9462417

            SHA256

            f1d365244c4d85454404359b41e39f3ac35c0d6dea0f3571d5813a6ab8504b7a

            SHA512

            38d7b5d19a4d84f588e6efbc8760880f8e90bbe89e1aa9e979d5bb323805a788abffec2ea47634e8a3567625c8e082fa98de3b4a2651acefbf739d138bcbc9ce

          • memory/5044-534-0x0000029245090000-0x0000029245098000-memory.dmp

            Filesize

            32KB

          • memory/5044-526-0x0000029246910000-0x0000029246A26000-memory.dmp

            Filesize

            1.1MB

          • memory/5044-539-0x0000029246A30000-0x0000029246AE2000-memory.dmp

            Filesize

            712KB

          • memory/5044-540-0x0000029246AF0000-0x0000029246B8C000-memory.dmp

            Filesize

            624KB

          • memory/5044-541-0x0000029246130000-0x000002924615C000-memory.dmp

            Filesize

            176KB

          • memory/5044-542-0x00000292466D0000-0x00000292466F4000-memory.dmp

            Filesize

            144KB

          • memory/5044-538-0x00000292460F0000-0x00000292460FA000-memory.dmp

            Filesize

            40KB

          • memory/5044-536-0x0000029246030000-0x0000029246038000-memory.dmp

            Filesize

            32KB

          • memory/5044-543-0x0000029246B90000-0x0000029246BC2000-memory.dmp

            Filesize

            200KB

          • memory/5044-535-0x00000292460D0000-0x00000292460EA000-memory.dmp

            Filesize

            104KB

          • memory/5044-522-0x0000029246730000-0x000002924690E000-memory.dmp

            Filesize

            1.9MB

          • memory/5044-544-0x00000292471F0000-0x0000029247808000-memory.dmp

            Filesize

            6.1MB

          • memory/5044-532-0x0000029246050000-0x000002924606C000-memory.dmp

            Filesize

            112KB

          • memory/5044-524-0x0000029246070000-0x00000292460C2000-memory.dmp

            Filesize

            328KB

          • memory/5044-530-0x0000029245000000-0x000002924500A000-memory.dmp

            Filesize

            40KB

          • memory/5044-537-0x0000029246040000-0x000002924604A000-memory.dmp

            Filesize

            40KB

          • memory/5044-520-0x0000029246460000-0x000002924654C000-memory.dmp

            Filesize

            944KB

          • memory/5044-518-0x00000292463B0000-0x000002924645E000-memory.dmp

            Filesize

            696KB

          • memory/5044-545-0x0000029246BD0000-0x0000029246BE2000-memory.dmp

            Filesize

            72KB

          • memory/5044-546-0x0000029246BF0000-0x0000029246C06000-memory.dmp

            Filesize

            88KB

          • memory/5044-547-0x0000029246E30000-0x0000029246E48000-memory.dmp

            Filesize

            96KB

          • memory/5044-548-0x0000029246EA0000-0x0000029246EEC000-memory.dmp

            Filesize

            304KB

          • memory/5044-549-0x0000029246FB0000-0x000002924706A000-memory.dmp

            Filesize

            744KB

          • memory/5044-550-0x0000029246EF0000-0x0000029246F14000-memory.dmp

            Filesize

            144KB

          • memory/5044-551-0x0000029246F90000-0x0000029246FA2000-memory.dmp

            Filesize

            72KB

          • memory/5044-554-0x0000029247B40000-0x0000029247E6E000-memory.dmp

            Filesize

            3.2MB

          • memory/5044-528-0x0000029246010000-0x000002924602A000-memory.dmp

            Filesize

            104KB

          • memory/5044-516-0x0000029246160000-0x00000292463A2000-memory.dmp

            Filesize

            2.3MB

          • memory/5044-514-0x000002922A950000-0x000002922AC40000-memory.dmp

            Filesize

            2.9MB