Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 01:17

General

  • Target

    sogou_pinyin_guanwang.exe

  • Size

    181.2MB

  • MD5

    42b9b4f540a534b0b7db83e9aba9d90d

  • SHA1

    57b56ba1dd6f9cf41c181c631f8cf829bab80607

  • SHA256

    c1103842cdc46be114dff25ae7e3b59e2a014133945d68eaffe02e84b2078b02

  • SHA512

    8983df90e6952725b54495516dd328760f9c9e37162589a55c16db2986063d9e0644f47157e9786a473f9da9bb37a5ac74fcbd818493443d17536e1abbc424eb

  • SSDEEP

    3145728:A/kfnZZRUWXNShZNxlb3oeUFRGp/K3GgUCoQKAQ6h398AWXNOQ14BDndvdXi37Dk:jnTLXwXNf4eUSJK39U8KAQ6hN8AW9H1m

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
    "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
      "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1328
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:16156
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1724
    • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
      "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
        "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:5124
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 2 127.0.0.1
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:20828
      • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
          "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
          4⤵
            PID:6380
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:16168
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 2 127.0.0.1
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:29296
          • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
            "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
            4⤵
              PID:9520
              • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                5⤵
                  PID:20328
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul
                    6⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:31452
                    • C:\Windows\SysWOW64\PING.EXE
                      ping -n 2 127.0.0.1
                      7⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:16292
                • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                  "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                  5⤵
                    PID:20380
                    • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                      "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                      6⤵
                        PID:15392
                      • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                        6⤵
                          PID:1716
                          • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                            "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                            7⤵
                              PID:16480
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul
                                8⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:15744
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping -n 2 127.0.0.1
                                  9⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:16232
                            • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                              "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                              7⤵
                                PID:9132
                                • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                  "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                  8⤵
                                    PID:15928
                                  • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                    "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                    8⤵
                                      PID:15988
                                      • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                        "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                        9⤵
                                          PID:16116
                                        • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                          "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                          9⤵
                                            PID:15504
                                            • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                              "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                              10⤵
                                                PID:9564
                                              • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                10⤵
                                                  PID:19960
                                                  • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                    11⤵
                                                      PID:26756
                                                    • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                      11⤵
                                                        PID:9000
                                                        • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                          12⤵
                                                            PID:3796
                                                          • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                            12⤵
                                                              PID:3608
                                                              • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                13⤵
                                                                  PID:29120
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul
                                                                    14⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    PID:9424
                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                      ping -n 2 127.0.0.1
                                                                      15⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:6212
                                                                • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                  13⤵
                                                                    PID:17060
                                                                    • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                      14⤵
                                                                        PID:18044
                                                                      • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                        14⤵
                                                                          PID:18136
                                                                          • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                            15⤵
                                                                              PID:15200
                                                                            • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                              15⤵
                                                                                PID:24852
                                                                                • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                  16⤵
                                                                                    PID:3840
                                                                                  • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                    16⤵
                                                                                      PID:10072
                                                                                      • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                        17⤵
                                                                                          PID:20204
                                                                                        • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                          17⤵
                                                                                            PID:13152
                                                                                            • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                              18⤵
                                                                                                PID:25948
                                                                                              • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                                18⤵
                                                                                                  PID:8200
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                                    19⤵
                                                                                                      PID:7572
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul
                                                                                                        20⤵
                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                        PID:26844
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                                      19⤵
                                                                                                        PID:15156
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                                          20⤵
                                                                                                            PID:14048
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                                            20⤵
                                                                                                              PID:5776
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                                                21⤵
                                                                                                                  PID:13180
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                                                  21⤵
                                                                                                                    PID:12356
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                                                      22⤵
                                                                                                                        PID:18920
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                                                        22⤵
                                                                                                                          PID:9952
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"
                                                                                                                            23⤵
                                                                                                                              PID:15380
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
                                                                                                                              23⤵
                                                                                                                                PID:29184
                                                                                  • C:\Windows\SysWOW64\Phija.exe
                                                                                    C:\Windows\SysWOW64\Phija.exe -auto
                                                                                    1⤵
                                                                                      PID:12984
                                                                                      • C:\Windows\SysWOW64\Phija.exe
                                                                                        C:\Windows\SysWOW64\Phija.exe -acsi
                                                                                        2⤵
                                                                                          PID:16196
                                                                                      • C:\Windows\SysWOW64\Phija.exe
                                                                                        C:\Windows\SysWOW64\Phija.exe -auto
                                                                                        1⤵
                                                                                          PID:17852
                                                                                        • C:\Windows\SysWOW64\Phija.exe
                                                                                          C:\Windows\SysWOW64\Phija.exe -auto
                                                                                          1⤵
                                                                                            PID:31672
                                                                                            • C:\Windows\SysWOW64\Phija.exe
                                                                                              C:\Windows\SysWOW64\Phija.exe -acsi
                                                                                              2⤵
                                                                                                PID:12428
                                                                                            • C:\Windows\SysWOW64\Phija.exe
                                                                                              C:\Windows\SysWOW64\Phija.exe -auto
                                                                                              1⤵
                                                                                                PID:17620
                                                                                                • C:\Windows\SysWOW64\Phija.exe
                                                                                                  C:\Windows\SysWOW64\Phija.exe -acsi
                                                                                                  2⤵
                                                                                                    PID:16760
                                                                                                • C:\Windows\SysWOW64\Phija.exe
                                                                                                  C:\Windows\SysWOW64\Phija.exe -auto
                                                                                                  1⤵
                                                                                                    PID:6552
                                                                                                    • C:\Windows\SysWOW64\Phija.exe
                                                                                                      C:\Windows\SysWOW64\Phija.exe -acsi
                                                                                                      2⤵
                                                                                                        PID:28100
                                                                                                    • C:\Windows\SysWOW64\Phija.exe
                                                                                                      C:\Windows\SysWOW64\Phija.exe -auto
                                                                                                      1⤵
                                                                                                        PID:7704

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\H9dktaBeOIgh1.exe

                                                                                                        Filesize

                                                                                                        7.7MB

                                                                                                        MD5

                                                                                                        fcb567580061e72a4fc2f0546c1a16e3

                                                                                                        SHA1

                                                                                                        e1067931d0a684aad46b65545c9908e93e970747

                                                                                                        SHA256

                                                                                                        c6dd859819a7e14728cdc3c14fb1e00d94f905b26655fc56c99a0f428cc737ec

                                                                                                        SHA512

                                                                                                        637020414a2d9f8940cee8665f70bc3e6ebdbdb3676d3a70483c9a32dee917ef5f6db75150f11543f5949fa27fa42420d5e97c6a09338778840caa5c82fad188

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe

                                                                                                        Filesize

                                                                                                        27.5MB

                                                                                                        MD5

                                                                                                        5d36204cd16f8081f1711b3910dc6907

                                                                                                        SHA1

                                                                                                        8eddb28bd6fca46be221e30008153f8f27aa9c09

                                                                                                        SHA256

                                                                                                        b100cb0d2b60c6caf1ff8e607967f4508c0c7b001f2a45b09fc916a3235dd968

                                                                                                        SHA512

                                                                                                        302b61b1dd23ce94b8773609c2258ca8503d0f22154c1c7780219981c39bcaa679c68a0d3e32ad4018a27ff2d0000f24151128b3ea716cb88614d9b2a3982f38

                                                                                                      • memory/1160-21-0x0000000005810000-0x0000000007398000-memory.dmp

                                                                                                        Filesize

                                                                                                        27.5MB

                                                                                                      • memory/1160-23-0x0000000005810000-0x0000000007398000-memory.dmp

                                                                                                        Filesize

                                                                                                        27.5MB

                                                                                                      • memory/1328-30-0x0000000077490000-0x00000000774D7000-memory.dmp

                                                                                                        Filesize

                                                                                                        284KB

                                                                                                      • memory/1328-840-0x0000000003D10000-0x0000000003E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                      • memory/1328-845-0x0000000003D10000-0x0000000003E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                      • memory/1328-3713-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3759-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3757-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3755-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3753-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3751-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3749-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3747-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3745-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3743-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3741-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3739-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3737-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3735-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3733-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3731-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3729-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3727-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3725-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3723-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3721-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3719-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3717-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3715-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3711-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3709-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-3703-0x00000000039D0000-0x0000000003A71000-memory.dmp

                                                                                                        Filesize

                                                                                                        644KB

                                                                                                      • memory/1328-849-0x0000000003D10000-0x0000000003E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                      • memory/1328-847-0x0000000003D10000-0x0000000003E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                      • memory/1328-843-0x0000000003D10000-0x0000000003E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                      • memory/1328-841-0x0000000003D10000-0x0000000003E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.1MB