Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 02:27

General

  • Target

    c219c1f5ed34389e8204a5efcddd1bb4_JaffaCakes118.html

  • Size

    194KB

  • MD5

    c219c1f5ed34389e8204a5efcddd1bb4

  • SHA1

    01b85bb6f50241951ff4f2d2452a4be4bda777ca

  • SHA256

    cad05ca33a1e51fc47d4e3416679737fdf6d5bfeca41a4b25b7f0c7ec6f53004

  • SHA512

    d30ef0eb13ff1d795d3a9b8b05d97c4ff79990b3f1248d5af907d9c58fba7a8ccb9a661614d597a8d724715abcbd46b6a669c7a0e14c1d7166f44a53f7e914d7

  • SSDEEP

    3072:SEXXG9yyfkMY+BES09JXAnyrZalI+Ye47uM9f7UL:SGisMYod+X3oI+Ye4pf7UL

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wininit.exe
    wininit.exe
    1⤵
      PID:380
      • C:\Windows\system32\services.exe
        C:\Windows\system32\services.exe
        2⤵
          PID:472
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch
            3⤵
              PID:592
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                4⤵
                  PID:1596
                • C:\Windows\system32\wbem\wmiprvse.exe
                  C:\Windows\system32\wbem\wmiprvse.exe
                  4⤵
                    PID:1076
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                    4⤵
                      PID:832
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k RPCSS
                    3⤵
                      PID:668
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                      3⤵
                        PID:740
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                        3⤵
                          PID:808
                          • C:\Windows\system32\Dwm.exe
                            "C:\Windows\system32\Dwm.exe"
                            4⤵
                              PID:1164
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs
                            3⤵
                              PID:848
                              • C:\Windows\system32\wbem\WMIADAP.EXE
                                wmiadap.exe /F /T /R
                                4⤵
                                  PID:2740
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService
                                3⤵
                                  PID:960
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService
                                  3⤵
                                    PID:112
                                  • C:\Windows\System32\spoolsv.exe
                                    C:\Windows\System32\spoolsv.exe
                                    3⤵
                                      PID:940
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                      3⤵
                                        PID:652
                                      • C:\Windows\system32\taskhost.exe
                                        "taskhost.exe"
                                        3⤵
                                          PID:1100
                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                          3⤵
                                            PID:788
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                            3⤵
                                              PID:2456
                                            • C:\Windows\system32\sppsvc.exe
                                              C:\Windows\system32\sppsvc.exe
                                              3⤵
                                                PID:1500
                                            • C:\Windows\system32\lsass.exe
                                              C:\Windows\system32\lsass.exe
                                              2⤵
                                                PID:488
                                              • C:\Windows\system32\lsm.exe
                                                C:\Windows\system32\lsm.exe
                                                2⤵
                                                  PID:496
                                              • C:\Windows\system32\csrss.exe
                                                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                1⤵
                                                  PID:388
                                                • C:\Windows\system32\winlogon.exe
                                                  winlogon.exe
                                                  1⤵
                                                    PID:428
                                                  • C:\Windows\Explorer.EXE
                                                    C:\Windows\Explorer.EXE
                                                    1⤵
                                                      PID:1200
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c219c1f5ed34389e8204a5efcddd1bb4_JaffaCakes118.html
                                                        2⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2132
                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
                                                          3⤵
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2404
                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: MapViewOfSection
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2764

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      ac32943559b2a4dc3ef8caf7385200c3

                                                      SHA1

                                                      127c297b14e4ddd52671a4112413aaad7aaff166

                                                      SHA256

                                                      a6c269270d25359a6f61d0c1b8f61ea26c32e1d9a3e18dbafafa905f1fdbb864

                                                      SHA512

                                                      d7333995290922f0807e9d5e627d4c82cbdb7ff8f39eea47b33dce464be36b8100900e2bbb3e7e0917b29c870b5c507815ab4bdeacb432591ea784ef2cfa02a0

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      945ddfac7af70d508839462348474bf5

                                                      SHA1

                                                      7524a0e11611845fae5c1da268e462d3b765d76f

                                                      SHA256

                                                      f81208f4453beb39e57df827d9b4cb531ff7d7e8d8269d808bbae851396a5d8a

                                                      SHA512

                                                      a1b27fd68aead2c57439e5efa4c33042e8f0f4198fd94b25aba2141035cdeb55fed923e1c77f60bfc30ce0fc153189275ff026c561d5af8ea5b0d3f8773435f9

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      f1f9f7342f4128e5d24ab2d2d55bab59

                                                      SHA1

                                                      0e3d075d6158217e939768f6ed1b7694e822dec9

                                                      SHA256

                                                      7a9b485ac1c56d47f0045bd493660892aace47056bf71edf3aea69dcecf1b775

                                                      SHA512

                                                      85b6426f20aa7dc7cede19368b646fb81e39f44becf5944853a7f2e83801b87a3249f0f5038182791210a0c0eee1890f2bad9fb5a11f281443e131876e5e6a8b

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      9afda686544a08441412316cd00b5537

                                                      SHA1

                                                      98e725d5ab17be1bf591066fc63daa8bc6946297

                                                      SHA256

                                                      479e78614632365bc23f3b6b7b4c22926172323599a888b210804dd41de01df6

                                                      SHA512

                                                      1e9f5b067fc34006a1b2f7d1cd78065fe7217c642102cf4e0b5858f2348325813d318dfdb4c4cb6a28c9dfc976df5fa685a18575d10c524f7852770d7fdce17c

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      ac4e5ca8c2042e910a695709f513694a

                                                      SHA1

                                                      876b50a5fe943a979803111cd9dc02a30bc62e43

                                                      SHA256

                                                      17ed44fe659ce8046734c33ffc893c366dd3de44b8e4fbd7a14f886b21ddf363

                                                      SHA512

                                                      2769a28f0daab0af90b68f2c107d607a75db2f1c0e9cd7a8e487a12661ad9cd45acafed1e46fc91289d45603149c861b65ac7535dbdba8e4b9a775de6967280a

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      021f877032dd301fbdfec6046e04df01

                                                      SHA1

                                                      946e4e388f2b3025d39c2425fbe32f571377c407

                                                      SHA256

                                                      4b95c3e92184cd2d3861c33b0805eca44505b49cb58b11515f461a396d2934c1

                                                      SHA512

                                                      4f224590096cac2059a61eee1ef7c4f8e06e868a47d262775c7bfc8093fe4d7997fc92f657fc0307fb106cb5d27c75418400b3daeb20fab0e6c0b7e28fb828ca

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      e37004468a5570e1ca15e3178315e269

                                                      SHA1

                                                      b5cacc95771c10257fe39704ac6d0a17e4659890

                                                      SHA256

                                                      028fbd8b689f8ee871ddf6b0d04ab3fc44db0eacee085c2cfc2c175ea0fedf12

                                                      SHA512

                                                      ec87b7bfeb616079d958f6d172c20c393da1fb03288961cce6aa9aa6e43a46451d87741aab05b4d31501d33648fff879fcbf2c035ccbd37965d8948870bd7de5

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      e2e6510816c1f9b9d9d79c72ec02ea99

                                                      SHA1

                                                      671da4616ef65f6daf1dcc1f437059bede2fa9a2

                                                      SHA256

                                                      a5e8261a40628713210bb3fd34fb6c1f7498b554863d1163a308cf4362aabe46

                                                      SHA512

                                                      04769a488bfe73d0704074f741c76a234f4fa23c6116967246be57b9e3022bbf47425e94154dc65888de0538dc787afccae97c701de80e72079ae51bd798c9ed

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      df30caa54d18eef06fa9d98297a24d7f

                                                      SHA1

                                                      1b212687ae6b2c7535834155ed551350021b3937

                                                      SHA256

                                                      6662899230ccee15c8db4df624048f0c9195898907001e07fc7cf5b180196d97

                                                      SHA512

                                                      dc6d17afb3a1f4c443c0f149b4b6c8dbd2a12b5ed33ca51e81ae125ab8211aaf3edf6d883972860cf0e0c4591c9c7c6fdba2fbb71096a4dbc26f5858f1b27510

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      802bc99d84430c7ad2c6d8d8ddc0dd33

                                                      SHA1

                                                      9efb456e6dc440b780f31ed0ebccc894961202ec

                                                      SHA256

                                                      d4cad87cdc95b97b66bd2632c1343e642b9b1ed7bc1946b9fe5b21be122363ac

                                                      SHA512

                                                      c893981fc09c3668a033d01cd445dadaaad5281e61f89ba4d0908fe72b361acad867cbf39003f7bc47451f1c73c5db2ce4f8f5b41a5ca6181d60a1992ff52301

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      08639027f55ed3d463f3f4edf9f2f9b0

                                                      SHA1

                                                      4f3afa8b37d90183dd0433a3e6fe34b9232b7d54

                                                      SHA256

                                                      6177ceb42b2f9cb66e33179f298f25594686bee09124f0a85826ed0dbf6dba28

                                                      SHA512

                                                      d3aad1b43fa4383de6a18a8a9577b734e29ec2dd56ea6771040ce9b6d9d486653b90e836a7155fe7c9fa39d956d3e4903877b4c9da148ef571aa6a1d3d6a2b20

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      f8dce16e1744344d539d3aea174235bb

                                                      SHA1

                                                      80999c805afa1efbdb74b6120f7eb3c29a23f572

                                                      SHA256

                                                      9cbfa1cbbf563a487280bd08b8f0cb5663db6f71151f669ed9a7f7c5b8221599

                                                      SHA512

                                                      f7e10a5a5d08a96d05d9ef082af8ae0657e93e3bdaf8d22738123dd88aa0f7e65b16dc0609087fe6e729d4492a7ea998f90f2ab4857d12b07f2b994663d0d975

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      f7729292bc5b766034d31da5072765ca

                                                      SHA1

                                                      9cb4e77b392b213cb49796009c620c4f8799e859

                                                      SHA256

                                                      db43aca938eaa02c2f9f37258b1fc33d3952ec2530d329f87a1f04c9e7ccf230

                                                      SHA512

                                                      e4a2f9cbc477912387ad2cb6ad777d4d646761874d011062b2af471e1cbb8d8d8a110a8d059a70a3fa6b810afc96376c7caef5ad1dccd08a5ea4726beaaa3308

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      81cdc0a40194c0c343d6d5027ded3005

                                                      SHA1

                                                      4ba8f49a4f05ed4698041f8a86d36a6492fc9f18

                                                      SHA256

                                                      793da79809807077b051bc401e86bc375917657be4e409c544b8ab404eb8036c

                                                      SHA512

                                                      fcaadbf36d568aeb692006433b2bf621b639f0a48890d20b476302186cea28d683d09abbb70dc26998cb4d475998bac6e0a3d059b5238da55404cfd28d04d58c

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      e8c74e1443ed86efd09566f3f9da2115

                                                      SHA1

                                                      6708cfd56788eb224972c97b0e2410d0fc71aaac

                                                      SHA256

                                                      37c21e250f2ebb496bdbc507270e5796240041d6de3e19647e674068423d6f3c

                                                      SHA512

                                                      c9f3964bed834be13cc14d257145af7b0e66e2943fdd02f72b7e0e9f903d35f74fbd9ccd5bfc81752b81e7c7624a1c045a1e24a96bd19235e20fe4957332312c

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      ea82e6f22ae4e5c3e9d1ed7813572cf6

                                                      SHA1

                                                      29c42c3c8ea045dfebd2158c0c05b9cca16ed52a

                                                      SHA256

                                                      46eebcccf5fae2aaa6cc4b7b018b52c1d702b2fc756389dabf7094b62251fa65

                                                      SHA512

                                                      fcde9cbb0f3e8f8b1e12ca7276b2e2184b147dd983773bb5da5e423c072f191d5ca10767503bf06c8b6d023b836a216e0a784b333da4e2e79a67a05ca83d14bd

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      3fe2fa2d01da74f9f938c378021f47de

                                                      SHA1

                                                      7a5f8408aac488ff1d24d291cda908363ca5e721

                                                      SHA256

                                                      fa0c9aa9e981923b3d23085dfabcd025f5bf0d4c14ce0226f16706d7eaa1598b

                                                      SHA512

                                                      f4932f31056e1cc0247ff3dbbc8f9331f3c6353368e496750176e40f16c04a38b3760ff5935bdbb087e2d31887048c486d9e59765cfae6627ab3c02be3f6eafe

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      4aaf4fdffa5e9216380eab5284b64839

                                                      SHA1

                                                      2d4119477a29e1f9338d7e6c518c435d45e685e0

                                                      SHA256

                                                      e79c860d16dcbefad8af0284a6d19ad03a955114c6e15cd97e91c301234ff141

                                                      SHA512

                                                      ba01c2521af42f7a68cacbf38a0776a477d1135ecfc126bb2ed36212ce70b5b84db60403da82b0c5de6e268ae74e42eb87870fd66ab9eba357e237bdd840f538

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      5176f7260fffd409404bf3fd7dd52294

                                                      SHA1

                                                      7f8595f53cc96edff905ee4ef4f4e8da7895b4c3

                                                      SHA256

                                                      808f10c94045f9ad24944f7b131a6c844e5f9ebaae0f2569f93320f4f1044ff2

                                                      SHA512

                                                      d82c4cd4df416a9c9475f83d59d416cf72d88328ac3b913f384c58dc16d4467144e21d1e97c0882b09b8229031401dad9183b8942daf98c1465eff86edbd11c7

                                                    • C:\Users\Admin\AppData\Local\Temp\CabEFFD.tmp

                                                      Filesize

                                                      70KB

                                                      MD5

                                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                                      SHA1

                                                      1723be06719828dda65ad804298d0431f6aff976

                                                      SHA256

                                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                      SHA512

                                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                    • C:\Users\Admin\AppData\Local\Temp\TarF05E.tmp

                                                      Filesize

                                                      181KB

                                                      MD5

                                                      4ea6026cf93ec6338144661bf1202cd1

                                                      SHA1

                                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                                      SHA256

                                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                      SHA512

                                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                    • \Users\Admin\AppData\Local\Temp\svchost.exe

                                                      Filesize

                                                      84KB

                                                      MD5

                                                      cc9104bc71a23e14787188f3634a4d05

                                                      SHA1

                                                      0b537406933abc1738ef32b96069961d024f1b8e

                                                      SHA256

                                                      aa797033a44b0ab42e6428552b5e85bc735c84082493f63b4b3ad0843859b28c

                                                      SHA512

                                                      023b9655cef044082ceb44c6644d834e4ba9af088843674cc8e816cb4f4981bf0958b0c82002c1597c8818e57af0f80d4cf3ab771e68af5a33cff752363c7df3

                                                    • memory/2764-14-0x0000000000400000-0x0000000000436000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/2764-13-0x0000000000280000-0x000000000028F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/2764-12-0x0000000077BA0000-0x0000000077BA1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2764-11-0x0000000077B9F000-0x0000000077BA0000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2764-9-0x0000000000400000-0x0000000000436000-memory.dmp

                                                      Filesize

                                                      216KB