Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    135s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/08/2024, 10:20

General

  • Target

    Steam.exe

  • Size

    51KB

  • MD5

    eb794f3819b32c9fbc747309bb04cd68

  • SHA1

    a6c24bfb6c2ea4cdf10f0f54c0a4e8ac0380beb3

  • SHA256

    e8fd34b40b83391a855905620e4beeb153d256df196b063bc7845d747f1e7d67

  • SHA512

    0b6cf31c799513b4e0f5ac21180cc7a26451fc54504f03ace353a5a8c598885c594b3375e990ac442e08ffaa1f3e9692cbf6dfb8c035b4380497cefd57288aaf

  • SSDEEP

    768:juMMmVn76G3rspEacCIQgttZX+2V2ltnq7oTmggkbm1t+tuXSWCalOIhu//t/:SMDnv7sKEIHLXyBqCmjkbmn/weOImF/

Malware Config

Extracted

Family

xworm

C2

tree-cleaning.gl.at.ply.gg:33027

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Steam.exe
    "C:\Users\Admin\AppData\Local\Temp\Steam.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://guns.lol/tuesday.cs
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf40c3cb8,0x7ffcf40c3cc8,0x7ffcf40c3cd8
        3⤵
          PID:484
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
          3⤵
            PID:2776
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3276
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
            3⤵
              PID:3264
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
              3⤵
                PID:1644
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                3⤵
                  PID:3520
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                  3⤵
                    PID:1496
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
                    3⤵
                      PID:3700
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
                      3⤵
                        PID:4572
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                        3⤵
                          PID:3680
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
                          3⤵
                            PID:4632
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                            3⤵
                              PID:4256
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                              3⤵
                                PID:4452
                              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
                                3⤵
                                  PID:3460
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:560
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                                  3⤵
                                    PID:1708
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
                                    3⤵
                                      PID:3960
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,12305854528378827816,14818971219279623086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
                                      3⤵
                                        PID:4704
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://guns.lol/tuesday.cs
                                      2⤵
                                        PID:4904
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf40c3cb8,0x7ffcf40c3cc8,0x7ffcf40c3cd8
                                          3⤵
                                            PID:2832
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2BF8.tmp.bat""
                                          2⤵
                                            PID:832
                                            • C:\Windows\system32\timeout.exe
                                              timeout 3
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:1548
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:2828
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:5024

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              3e2612636cf368bc811fdc8db09e037d

                                              SHA1

                                              d69e34379f97e35083f4c4ea1249e6f1a5f51d56

                                              SHA256

                                              2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

                                              SHA512

                                              b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              e8115549491cca16e7bfdfec9db7f89a

                                              SHA1

                                              d1eb5c8263cbe146cd88953bb9886c3aeb262742

                                              SHA256

                                              dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

                                              SHA512

                                              851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87e801c5-6fc7-484b-b73b-7e2adf367c8a.tmp

                                              Filesize

                                              204B

                                              MD5

                                              2cbfaef43d64b3f61913345d1488af13

                                              SHA1

                                              2b25abfcc43dfe3fd1b9bed4414d2cdb0771238c

                                              SHA256

                                              b383bea5341ed9fd4e0fbf7e35652a905ca4ea3dc8f79883b0241f2fbbdbd0c0

                                              SHA512

                                              2c327e25fc5613ccabb89d0ed7c7b68d20c569447d5ea45423af0684ee0932920ed8de27e27011be0a41352a159de1b5e3d7b93fd9ffad6a6822cb71ac420785

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              192B

                                              MD5

                                              e09c132bc227517fc86eb7a7d5f24d12

                                              SHA1

                                              81895120baeeb01efeb9e4cae268692381bf1855

                                              SHA256

                                              8b1e9a45e1bf59bb9a441c5c7bd842ecc5f55225fae004d6357d3cc2e0efa0ba

                                              SHA512

                                              59b267530393e9366b7e17c8003c104e4907e6587d23a294ab9a262cf327d4938dd14cfb634d24d8f14e0c916ea7be53d8ebcb95c89d2069bcf2bff79caee122

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              216B

                                              MD5

                                              5b2cc013bcc461bce38b8d6160ba79e2

                                              SHA1

                                              da7257db2bcebfd8b467894bf0d05ce30fb450bb

                                              SHA256

                                              464c5cbe82b5caa0126b06f75f0de26030a7e2929e3d55114d4ff6f23d562cc9

                                              SHA512

                                              d584794ca8a2ec56af4a95b7bf3864cbdbc453b567cdd8986b9beac878f5f2159df212df77d1e16194d41d39e40ec5a8d9f099c1f6485e4f92f8baed87f808df

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              3d008f5a709d522d3ed06780fd9bba9f

                                              SHA1

                                              e13161caf15330c30939ff47c9e970b94209a880

                                              SHA256

                                              466a67740fc5489a05ab8cc524e0f7455a5c5138e31fd0fa8487c6304304b6fa

                                              SHA512

                                              a754aae7696ed80c3895b1ab9f4ca66042535c394cd9852fffd7a3af335721b12dfde9bc8f24926f623e2f4c81c5e2583e10e20b8b19f2aa891e1d8f31f68ac3

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              d2e095a434e1032ac99b6e9b43069111

                                              SHA1

                                              4dcaf1632213148da92e168c4157bcab8e77f077

                                              SHA256

                                              df333763466e21d8a64d9252b37cbcd2c222e9b2417ac5cc6edadedddb996f72

                                              SHA512

                                              6af7d2b701a5a5360d7783ffc5a5bee6dac9a53f69914651c12e8db22fe09db55fb980e7b5a32cbe14c0c3bd2d4f55216aae71e8f44b82e1d7fcde7c19ba6d41

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              2602904a271f25c8b9d85b0473058d4e

                                              SHA1

                                              a918ce0ee95ea2021aa12d908989e531159c53a2

                                              SHA256

                                              1a2e1a975d768d75eda8a790a7ad18e8e3f7cca51ba578ea732825e02289088f

                                              SHA512

                                              3fed0f780ff3e72e1f1bca480f2bc259cc12199764f5261d5d4453146b32069f6ffd95e057bbac1609cfe79f6f660c2b496f2747d3fe23cc134bdc8aa1e34c99

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              206702161f94c5cd39fadd03f4014d98

                                              SHA1

                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                              SHA256

                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                              SHA512

                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              76b72c922fa59f84af22dce8345c426c

                                              SHA1

                                              58153230760e96ca903748b0accd8f86cd5b6dd5

                                              SHA256

                                              9e5085fa295d7f472006d87c69c4d6e73f9ad141a9d91eaf5f368b6402c04aa2

                                              SHA512

                                              6e3a7a11269161c9687608e88e6859c771c17395a46f596ed68cc143963497a216feeeb7fe25bd06c8e497ae2a95285659d8331bb25aefe3e4c74bf2db7e6e22

                                            • C:\Users\Admin\AppData\Local\Temp\tmp2BF8.tmp.bat

                                              Filesize

                                              157B

                                              MD5

                                              128c30d593ce9df02211208491ad654d

                                              SHA1

                                              fd87d1d4daf37eff3269e4e26261fea9386c0cf6

                                              SHA256

                                              f1e28d7dae010f13ffcce11c623d6989d7297bef2f78cc8c8a6253f6aa3a1b4a

                                              SHA512

                                              bfca6edf2ab6a61bb8c94341fcbbfbfbadaebc0c0e3ec3f5e5cb153a6bb43dd7ffdff5998b5e3f99cb58d612d49bf2de1eb82f4b2dd0611c7803ec725a3d44b7

                                            • memory/672-3-0x00007FFCED9D0000-0x00007FFCEE492000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/672-0-0x00007FFCED9D3000-0x00007FFCED9D5000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/672-2-0x00007FFCED9D0000-0x00007FFCEE492000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/672-166-0x00007FFCED9D0000-0x00007FFCEE492000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/672-1-0x0000000000260000-0x0000000000274000-memory.dmp

                                              Filesize

                                              80KB