Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 16:34

General

  • Target

    480f83695dd50d652910613f062a934c85a8ac9bae32bb542e60255e8e85128e.exe

  • Size

    3.7MB

  • MD5

    f3e1737d81c846aeffe6dc434ef1a70d

  • SHA1

    6fb7d26916313e2264f6000b24159a684532ffa8

  • SHA256

    480f83695dd50d652910613f062a934c85a8ac9bae32bb542e60255e8e85128e

  • SHA512

    4f08d0f8be1ef3ce54c961532d7234d7301a25a28b3cb09ad29f6dc4c503946c1382c75ccb495722cd63bd7ffb365b758e1106504dbad71dc734d32e82ba90b1

  • SSDEEP

    98304:AqwnqwaZHBYnxTE2nC21V1QkGSKRgRzzHxthjfdRVD:AqwnqwoBv2eVSKRKvj1bD

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\480f83695dd50d652910613f062a934c85a8ac9bae32bb542e60255e8e85128e.exe
    "C:\Users\Admin\AppData\Local\Temp\480f83695dd50d652910613f062a934c85a8ac9bae32bb542e60255e8e85128e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        clamer.exe -priverdD
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1360
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\ad.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\ad.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2884
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1940
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1060
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2216
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:308
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2148
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1340
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2136
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2476
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\480f83695dd50d652910613f062a934c85a8ac9bae32bb542e60255e8e85128e.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2708
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\clamer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1180
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1112
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\WMIADAP.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1292
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pNxthjPhEh.bat"
            5⤵
              PID:2784
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:2972
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  6⤵
                    PID:2336
                  • C:\Program Files\Windows NT\Accessories\csrss.exe
                    "C:\Program Files\Windows NT\Accessories\csrss.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1872
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EP1yTPiaGq.bat"
                      7⤵
                        PID:1540
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          8⤵
                            PID:2716
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            8⤵
                              PID:2984
                            • C:\Program Files\Windows NT\Accessories\csrss.exe
                              "C:\Program Files\Windows NT\Accessories\csrss.exe"
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2516
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RVEN4vvioM.bat"
                                9⤵
                                  PID:704
                                  • C:\Windows\system32\chcp.com
                                    chcp 65001
                                    10⤵
                                      PID:2036
                                    • C:\Windows\system32\PING.EXE
                                      ping -n 10 localhost
                                      10⤵
                                      • Runs ping.exe
                                      PID:1168
                                    • C:\Program Files\Windows NT\Accessories\csrss.exe
                                      "C:\Program Files\Windows NT\Accessories\csrss.exe"
                                      10⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2896
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0T9X0LKmT6.bat"
                                        11⤵
                                          PID:2604
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            12⤵
                                              PID:2660
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              12⤵
                                                PID:2468
                                              • C:\Program Files\Windows NT\Accessories\csrss.exe
                                                "C:\Program Files\Windows NT\Accessories\csrss.exe"
                                                12⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1044
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6HUNmoPWiE.bat"
                                                  13⤵
                                                    PID:2700
                                                    • C:\Windows\system32\chcp.com
                                                      chcp 65001
                                                      14⤵
                                                        PID:1912
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        14⤵
                                                          PID:2560
                                                        • C:\Program Files\Windows NT\Accessories\csrss.exe
                                                          "C:\Program Files\Windows NT\Accessories\csrss.exe"
                                                          14⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2920
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe"
                                      4⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:2132
                                    • C:\Windows\system32\NOTEPAD.EXE
                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX1\dwa.txt
                                      4⤵
                                      • Opens file in notepad (likely ransom note)
                                      PID:2404

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\0T9X0LKmT6.bat

                                Filesize

                                225B

                                MD5

                                9e965788711820993026b57211b72e06

                                SHA1

                                46f61a9e189cef7bcc3c9ac03acf93c78a7fd664

                                SHA256

                                c5de70b7f0e39522e2d5f49eef456aee4a8a92d5a7d9d71931eceaf9b176d702

                                SHA512

                                c654e87d91e2a6e309d025c81156be8f47cdec6fc33dbad44da0a75b819d113e0f34da4d9a1eb236ae82931f9cc84cff806a86fbab4a6a7b201ead733fddeb89

                              • C:\Users\Admin\AppData\Local\Temp\6HUNmoPWiE.bat

                                Filesize

                                225B

                                MD5

                                ff5cdf2e6541883ac77238d49f826904

                                SHA1

                                ed151bd006364119ee7daa1e780d93b7b1034f1a

                                SHA256

                                1c1b33dc689e811b74c97cbe10e8ea785f68fc11190fa9ec0f9ad9cf60c1e6e5

                                SHA512

                                9c0d49c3bfe278780a5104e999ce6d991f04c792d7ec75591513b8cd89841305bf16ab342899b07f12ad3c7d681ca01abd1534532a0c8aad408a008b763fc889

                              • C:\Users\Admin\AppData\Local\Temp\EP1yTPiaGq.bat

                                Filesize

                                225B

                                MD5

                                2d293b0ddc94c51822afaa1bf15d914e

                                SHA1

                                c3f27f85b127b00bf68e49948cdd805d6ff1d7b4

                                SHA256

                                ab79b6437781ea232c58c39e2ec12d14b4a1993ab0e65e53ce5a2c4425940081

                                SHA512

                                659594b9e4c1a146dab67c1e9185bb4b1659ddb3792e8f6683fc55d8b415cefc02bcf92d755170e1a615baec07a8ed0cd93830469c159b8bd2d060539569711a

                              • C:\Users\Admin\AppData\Local\Temp\RVEN4vvioM.bat

                                Filesize

                                177B

                                MD5

                                b458112f9d532d36dc7b5d5e18b2eb79

                                SHA1

                                ff517a592ec1f39f8fc63f201510e3e7138629ed

                                SHA256

                                11ebfdea2057a50b014524d2b7ff9b12adb468344adaa4aef6a657d4c53a4733

                                SHA512

                                cfa697c7efa50f1d34b24a4f56bb9deba87321728e57f828d35566bdc366141f4bef9f03929a82f4a8509811cc896be48c0e8bc9aee4e93beacd39e658bbca61

                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

                                Filesize

                                37B

                                MD5

                                28151380c82f5de81c1323171201e013

                                SHA1

                                ae515d813ba2b17c8c5ebdae196663dc81c26d3c

                                SHA256

                                bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

                                SHA512

                                46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\ad.exe

                                Filesize

                                2.3MB

                                MD5

                                fba36b0b385397a0a9190abfd3332f92

                                SHA1

                                f7f2b3979fe2695803a285e399fae69dd651e767

                                SHA256

                                19d8a5c007460fd0c78d139bb6d40ddea4887a54b8fea1aabcfd9cf821355598

                                SHA512

                                8a36c80ac49a432a50e9349613d97719367f7c84f8f2c1332a9fb5ec612b847fb50ca52ffebea85b46ca9de1ee1ede2992f1c358575a222b81268e2210422806

                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\dwa.txt

                                Filesize

                                5KB

                                MD5

                                a8aba49b4924d5acc914e914d747435d

                                SHA1

                                c412f9ca92a962c3c076724f7d449eaf33f1b8bc

                                SHA256

                                820a8158f1ec44b3d46c4f53bffc81d912e73f23e6203d3f7faa397180950db2

                                SHA512

                                33fc2135fedb527bbc4c84b0cafa566da8ed5317dd3a957676f045ac17da635de889ea39842a3c612312061cd4e94ef9e48ca7583b780aee2d77cbdb5b73a27d

                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fwa.exe

                                Filesize

                                545KB

                                MD5

                                87a5a4705b24429c4411a5a9be73590d

                                SHA1

                                df3ec5028c3f6a1a96665db7947e00e4045790a6

                                SHA256

                                04f9a7f216209a283e7339598c41d0ae839f130e048c72445a9a88598ca4fa1c

                                SHA512

                                b0411197c0be5d2e38cdffc36fb8dd42ff20e8d593395d8a6d124cfe817d5e860e4246301235452dfdddcb56d387adb6391a872cb60551ddf3f9aa0360443462

                              • C:\Users\Admin\AppData\Local\Temp\pNxthjPhEh.bat

                                Filesize

                                225B

                                MD5

                                fba92a99dc536fb2010cc78592d12d9e

                                SHA1

                                a9c4583a1b484f599e32079bab7f24351d868242

                                SHA256

                                c49d41d1a5855c96e3525f75ae723ba3e73c4c54ea624e71ab1d227d0c28fd78

                                SHA512

                                a31d61b098a8b5e5d49521d9a317ab196fcd8faa03c2ad0aa8d50bd151545ddd4d953708f97c0d1ebc525ad99ed84ea0a2b6228538ff4ea955d40fdc941a093a

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1XL9B7IXB845794ZCXCW.temp

                                Filesize

                                7KB

                                MD5

                                db4f0d0bcbd3238faa4adb3310d8b0ae

                                SHA1

                                61c3721f33a33b0340ca4f48b23fbac2e2b0256a

                                SHA256

                                f8034eccce225b27fce5620761f8567bd1252f9c05e46cf3df869f778a644f1b

                                SHA512

                                003392b9ff40cf516dc9e6f87869db1aedf7005be6f9b185300c2a8762ce0e147a91b1109f018a0541d09157fb3ede13996c8d2efbcf6cf393ddfd9c2a5f404b

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                Filesize

                                7KB

                                MD5

                                94aa1081d201b5d045b74bdd3a0f1cfc

                                SHA1

                                63d861f1fcd385a1d178cb0adc5fd62376784474

                                SHA256

                                8d7e63ec35f58f606ce2f3b40c32ddb60b6b7c506f0eb21395a018df4d2e628c

                                SHA512

                                92ccc965f4fc77fb13bcb105fdeb6fe263dacded4d89ccd620a1ad8f5bde8f398cb795773518473761c3e2dccaf132a897c6df7bc6e72f96494d8d8d71e48d15

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DABWBD79CK1FPMDQHOTW.temp

                                Filesize

                                7KB

                                MD5

                                057b86d591b592ffa140f1dc0fa80515

                                SHA1

                                4a200b3d04107bfcdfc9e3a9ed35cc24ed2a77c3

                                SHA256

                                f6eccc211b3c039dec7f33b8dffc114b86ce31ce0ca90169e7f8c86b25e3e69f

                                SHA512

                                8d46455f2004ab469808e1260221ac44e5ca45de76e4e90f5c81d2fb6ce0bb7cd1cd4b0d2cd30cff9a30b17ff275d631c4c999f1f4d538e13cc0929626c9000f

                              • \Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

                                Filesize

                                3.3MB

                                MD5

                                02ba8c5f08709d99bbebb9344af4ac46

                                SHA1

                                99ed4d61ac5749f285509a7b5e60c76ef9f4e0c4

                                SHA256

                                6599650c00dc01de8ead0554bb585ae4d1d14892f28e1311aae71ad3db38a4c1

                                SHA512

                                befcbd81405ccf53429bb9d77ccde886bbcc75422af262a9bb1be15a6be46e76203adbbfc30a1653fdd42c19295246a5a6e57aad80391bbc16bf72b26804938a

                              • memory/308-135-0x000000001B5B0000-0x000000001B892000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/1044-241-0x00000000012D0000-0x0000000001524000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/1076-53-0x0000000000320000-0x000000000032E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1076-47-0x0000000000370000-0x000000000038C000-memory.dmp

                                Filesize

                                112KB

                              • memory/1076-67-0x00000000003D0000-0x00000000003E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1076-69-0x0000000000D70000-0x0000000000DCA000-memory.dmp

                                Filesize

                                360KB

                              • memory/1076-71-0x0000000000550000-0x000000000055E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1076-73-0x0000000000560000-0x0000000000570000-memory.dmp

                                Filesize

                                64KB

                              • memory/1076-75-0x0000000000570000-0x000000000057E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1076-77-0x0000000000B50000-0x0000000000B68000-memory.dmp

                                Filesize

                                96KB

                              • memory/1076-79-0x0000000000580000-0x000000000058C000-memory.dmp

                                Filesize

                                48KB

                              • memory/1076-81-0x0000000000DD0000-0x0000000000E1E000-memory.dmp

                                Filesize

                                312KB

                              • memory/1076-63-0x0000000000530000-0x0000000000542000-memory.dmp

                                Filesize

                                72KB

                              • memory/1076-96-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/1076-61-0x0000000000510000-0x0000000000526000-memory.dmp

                                Filesize

                                88KB

                              • memory/1076-39-0x000007FEF5583000-0x000007FEF5584000-memory.dmp

                                Filesize

                                4KB

                              • memory/1076-59-0x00000000003E0000-0x00000000003F2000-memory.dmp

                                Filesize

                                72KB

                              • memory/1076-57-0x00000000003B0000-0x00000000003BE000-memory.dmp

                                Filesize

                                56KB

                              • memory/1076-55-0x0000000000330000-0x000000000033C000-memory.dmp

                                Filesize

                                48KB

                              • memory/1076-51-0x0000000000310000-0x000000000031E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1076-49-0x0000000000390000-0x00000000003A8000-memory.dmp

                                Filesize

                                96KB

                              • memory/1076-65-0x00000000003C0000-0x00000000003CE000-memory.dmp

                                Filesize

                                56KB

                              • memory/1076-40-0x0000000001370000-0x00000000015C4000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/1076-45-0x0000000000280000-0x000000000028E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1076-41-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/1076-43-0x0000000000340000-0x0000000000366000-memory.dmp

                                Filesize

                                152KB

                              • memory/1872-160-0x0000000000050000-0x00000000002A4000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/2516-187-0x0000000000360000-0x00000000005B4000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/2708-136-0x0000000001DB0000-0x0000000001DB8000-memory.dmp

                                Filesize

                                32KB

                              • memory/2896-214-0x00000000002F0000-0x0000000000544000-memory.dmp

                                Filesize

                                2.3MB