Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 07:46

General

  • Target

    2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe

  • Size

    5.7MB

  • MD5

    7f4d659cd45dcdab09d655024f070793

  • SHA1

    c93efe2fd41309a6b94fa9a3e3611c6158e139fd

  • SHA256

    283544ccaeb8547fc78ac6e287074cd1928a6415c6ecebee11d123bc9dcf8f39

  • SHA512

    3c7f9b3d8feede68f4d2e055cdf993621713196dd90e146528373c6e9a4da47b8438459b610b2afdac25519776ad50988798efd354bf2f842e61922cc1843a02

  • SSDEEP

    98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUt:j+R56utgpPF8u/7t

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Cobaltstrike family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 42 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 21 IoCs
  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-22_7f4d659cd45dcdab09d655024f070793_cobalt-strike_cobaltstrike_poet-rat.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\System\JHgxkhc.exe
      C:\Windows\System\JHgxkhc.exe
      2⤵
      • Executes dropped EXE
      PID:2056
    • C:\Windows\System\CKbaBPz.exe
      C:\Windows\System\CKbaBPz.exe
      2⤵
      • Executes dropped EXE
      PID:2000
    • C:\Windows\System\njHXYeC.exe
      C:\Windows\System\njHXYeC.exe
      2⤵
      • Executes dropped EXE
      PID:904
    • C:\Windows\System\WFHFNVt.exe
      C:\Windows\System\WFHFNVt.exe
      2⤵
      • Executes dropped EXE
      PID:2440
    • C:\Windows\System\URnSQTz.exe
      C:\Windows\System\URnSQTz.exe
      2⤵
      • Executes dropped EXE
      PID:2132
    • C:\Windows\System\YgEFayI.exe
      C:\Windows\System\YgEFayI.exe
      2⤵
      • Executes dropped EXE
      PID:2788
    • C:\Windows\System\PbigRky.exe
      C:\Windows\System\PbigRky.exe
      2⤵
      • Executes dropped EXE
      PID:2728
    • C:\Windows\System\BoYVhIv.exe
      C:\Windows\System\BoYVhIv.exe
      2⤵
      • Executes dropped EXE
      PID:2884
    • C:\Windows\System\UFlRloZ.exe
      C:\Windows\System\UFlRloZ.exe
      2⤵
      • Executes dropped EXE
      PID:2628
    • C:\Windows\System\hYnAkdU.exe
      C:\Windows\System\hYnAkdU.exe
      2⤵
      • Executes dropped EXE
      PID:2768
    • C:\Windows\System\ugniuec.exe
      C:\Windows\System\ugniuec.exe
      2⤵
      • Executes dropped EXE
      PID:2604
    • C:\Windows\System\RQQtyjg.exe
      C:\Windows\System\RQQtyjg.exe
      2⤵
      • Executes dropped EXE
      PID:2676
    • C:\Windows\System\oXLarMa.exe
      C:\Windows\System\oXLarMa.exe
      2⤵
      • Executes dropped EXE
      PID:2652
    • C:\Windows\System\wffAbmk.exe
      C:\Windows\System\wffAbmk.exe
      2⤵
      • Executes dropped EXE
      PID:2616
    • C:\Windows\System\ZsHVdoA.exe
      C:\Windows\System\ZsHVdoA.exe
      2⤵
      • Executes dropped EXE
      PID:1224
    • C:\Windows\System\aHliCjA.exe
      C:\Windows\System\aHliCjA.exe
      2⤵
      • Executes dropped EXE
      PID:560
    • C:\Windows\System\VZprGAw.exe
      C:\Windows\System\VZprGAw.exe
      2⤵
      • Executes dropped EXE
      PID:1980
    • C:\Windows\System\kRVqKzG.exe
      C:\Windows\System\kRVqKzG.exe
      2⤵
      • Executes dropped EXE
      PID:1144
    • C:\Windows\System\gowoRDC.exe
      C:\Windows\System\gowoRDC.exe
      2⤵
      • Executes dropped EXE
      PID:236
    • C:\Windows\System\nTFzuRE.exe
      C:\Windows\System\nTFzuRE.exe
      2⤵
      • Executes dropped EXE
      PID:1016
    • C:\Windows\System\DHZJpOM.exe
      C:\Windows\System\DHZJpOM.exe
      2⤵
      • Executes dropped EXE
      PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system\BoYVhIv.exe

    Filesize

    5.7MB

    MD5

    cccff9b380a789c07abf5597ddbfceb7

    SHA1

    ee79e8f7ffee199de46fe958214195a90f50ae93

    SHA256

    99b7d9e6c780a6813a1188a9e8cf7b48d445cc64bb58018d8da9f9596b781242

    SHA512

    89bbf6c88cfb0c7753a239a64be1b93ef125af915d9704e1269e0cf3cd9bac187b5a6fe8952cc992adf13b1ad3c8300bc107de27730a25de518f8077dfbfcb6b

  • C:\Windows\system\DHZJpOM.exe

    Filesize

    5.7MB

    MD5

    f212ec35b4287ce14d7a805b87459f52

    SHA1

    71a930c8b1c5b3d97882b01dd07d6dd500f3da00

    SHA256

    0f3abe2c1c5fd7fc3c7624a9770dceca02444fc485a1a29fc917a0b5ca69b576

    SHA512

    1b1ef44405b548a262b5363a152c702ec1afc8a6f1beca461724b5892adfabbd7c92afd2489e7d1db0615513992db848ac32a35158ab16b00e8211ccda1f00fe

  • C:\Windows\system\RQQtyjg.exe

    Filesize

    5.7MB

    MD5

    6e3b49419743e57c79e6a78272ab1dd9

    SHA1

    34c73ab4c0ac6233490d2aca6e1d06e1e505f79c

    SHA256

    63f1a5e5d8deed4bcd0a720e0fa4f1046498dd86e84c307c87b096363884534a

    SHA512

    df9630df5f6da81bad18bf5eb29314f672f0f43f1f509172b0646b19de744d6ae25e67b4c40ccb6d49e78b2047f14c30247425a2ab304be60bb6f9ae73532067

  • C:\Windows\system\UFlRloZ.exe

    Filesize

    5.7MB

    MD5

    029219a372c2023cba36796007a4d7cc

    SHA1

    2b7217ed27071a73e5b65b562b6ee04d63d4a3bc

    SHA256

    0b47503333e1aa73da15d645631e88b318d7f720f096e3296811ae3ea1d48635

    SHA512

    f77fde97b5440f5c8690236de74d39ed9d0642e09d3c6b21c85f156e5b9472f830939744659dda7427a70a3a829050f11a1452d3489c4afeac4a12ab76bfa71c

  • C:\Windows\system\ZsHVdoA.exe

    Filesize

    5.7MB

    MD5

    73ea9cce71bd26c3c6ee9c860d7db56a

    SHA1

    cf8f5c70f08ebd00badada9a5f890a6ef820b797

    SHA256

    0aafbd62d859f5cb23e6485e3673b3588e8066f95b7941de8368512b340253e1

    SHA512

    fa9e7d28989969f8882955603649a5bb1151460115d0c865de56c8b62bfe6208e7189394974b72fd0b31c730b58d07c4f11cb8ca85ecda388f0051f77dc71d1d

  • C:\Windows\system\aHliCjA.exe

    Filesize

    5.7MB

    MD5

    54b227c416d27c1316456f46c6cb3ff4

    SHA1

    61bbb0bd4dd34d6270050ade1970a4447ace9fc0

    SHA256

    4495d7298f2a39da6f894aabbadfa44dc215fa8055060c96122e5971fd0354ab

    SHA512

    34f02275832864630542f79cac35d8d5dae58d0ea7b26a7d95e48112b045fbbb67862cbf59db5eae7b31afd0f219ea8aadf5d3e05e5acd0b4364ce25cebcc95c

  • C:\Windows\system\gowoRDC.exe

    Filesize

    5.7MB

    MD5

    0702563ab6c39e700736496fd306c3cf

    SHA1

    ee2239be7fdfc283e3760ce8e3fc87957d7004cf

    SHA256

    e524806eac4f055789e0fe525d03958ae748d9f31e3f38bb313f277253ce6258

    SHA512

    9d2e8039049dde35b7e98234f00c83df0948a521afb5404222b3b9eda8f83155ac684002c9fdd3900b1c5cc53510ad11281cd7335ce49f0cc8b3e38f1491673d

  • C:\Windows\system\hYnAkdU.exe

    Filesize

    5.7MB

    MD5

    84986cdb647ee26dbd2a144b6f746e7d

    SHA1

    ec13b663c8b340c9daf14c22cb4f12ae46cd6b12

    SHA256

    d09fb2678a83b601b8081da5bf4fa6fd1d3363c3726c584d103caad2db837d72

    SHA512

    41e14010aa25e454f1717da57ae8a411e77b7acbc323c3ff5da2c7476ace33f593f9b4c1b75204d4193e9d72631a66a703bf81e81d4f6d306310ede0ac2b5a9e

  • C:\Windows\system\kRVqKzG.exe

    Filesize

    5.7MB

    MD5

    fca02f90a068b770ab6513c30b73e355

    SHA1

    77cf5bfd0edbea7337b32f96502a02bc280ea80a

    SHA256

    c33ab110d65fe5aa44dd92c38224c7a7b45aae51878ea6d82b14f219571af56c

    SHA512

    cd848ca3a3e7807f304a7a60d5da964270f212b271accd63bc8fd6790d6da77e728715a54c183cd41078e69f6c80f4c32ae98a4727f6ad18a4ba0ef26d301ea9

  • C:\Windows\system\nTFzuRE.exe

    Filesize

    5.7MB

    MD5

    51493903e98fa094aec034beb0edc87b

    SHA1

    96b6507cae901533f02022b9c52d33453727b20c

    SHA256

    22d8e483e640fbcce1ee222e3bacceb710093d9544310efbd3317085ff341bbf

    SHA512

    8e63842b6a937fb82ab3bef0c73b5661430b4bf95fad5e836e803a1aa0bafec5bb141290c4b8c99f088a26c4b564c1ebad3c0b1102ad9564545279dabff4887b

  • C:\Windows\system\oXLarMa.exe

    Filesize

    5.7MB

    MD5

    c2f04857c113eee9ce2afa54f0bca488

    SHA1

    73b0a496d1336f2a070446959cd6ccf09d9ad568

    SHA256

    99d830bfa0b8d7093f021d85e82b958d0cb8d0374ed9ff1dff7a7642cc03a013

    SHA512

    df78af1595a1dfeaeaaf20fbcd6ecf3c126e9c2919905a19847e5edabc3f52ad27c4fa3966156454e44e7913fe632cbabc32a808a30e0f8323ed930a439ade11

  • C:\Windows\system\ugniuec.exe

    Filesize

    5.7MB

    MD5

    cad38a987ee7793fd6a8526294a8234d

    SHA1

    6564e10b29e7f999b9a6aca02485578690cbfd3b

    SHA256

    e87453b1cdbebc8f89a6f95ea3b28ea0eab2d85d98706b65e0fa4121b3e5974d

    SHA512

    d534684fa45b41186bc8bf83742f6a3448e1931ce38ec985b4722e80ec37d62a63af37d776e4c38d31b98b4a59f311e3e553dbf4533dcaa405b34360f2a6038e

  • C:\Windows\system\wffAbmk.exe

    Filesize

    5.7MB

    MD5

    d5fa9e91f768342eafde9ef2251a55d7

    SHA1

    699131c68d4663d705fb36f3433d7dfaa7f6ccfe

    SHA256

    ea0bc42f3d0e420fec09850faebc35b555960d5db721175bc8cfc85d61ef6003

    SHA512

    6386501d62c74978fe84acd629c2b058b4dce7604f3f214615f36b99a8660430ff5e6b34caeb38495df2601eeb595bc7ce8d59dd88a681a15f98617de9fec61b

  • \Windows\system\CKbaBPz.exe

    Filesize

    5.7MB

    MD5

    5b1fd07b30538f09bfe1c1fd60039f96

    SHA1

    6c6b6f2a62d7a366208bb2c446274ef21c13f30f

    SHA256

    ade0139561f5461078b19964627c9642e7abf1257b994d2ffd6baa6dcb25f449

    SHA512

    11667395bea8381c34362754b92692998c5722dcabac99664d2dbf3998b698f5b46b79c9182608dfbc830de1cbbb634529854dd648e67298d2b1bd47e75030f7

  • \Windows\system\JHgxkhc.exe

    Filesize

    5.7MB

    MD5

    cc2c42f33c5c74cb6cfeb3e27fdf95ff

    SHA1

    df64e3c53d146502abc99cfdf46f8cbcba35783b

    SHA256

    4dfa32d762d1384a3804efaf641e478a2c6b528f6837ec16e69ce5ddbc1f70a2

    SHA512

    f248e998a889a1bc882c3695a5993f35929bdfaa98ee5b8df017581c4e0df4cd513c81adc6f8c9af05a159f731b8123603d21d5a4c3df689efa9a11adf782e77

  • \Windows\system\PbigRky.exe

    Filesize

    5.7MB

    MD5

    3f20f49d7e80960640d51a36681300b7

    SHA1

    3e9356d63172e5f59266d2ef52e27aaa4e54206f

    SHA256

    afb996c0b5f26f2c61716bd13dd3c76c10f06fe9653bf3313f99cf28ed63ad7b

    SHA512

    e2e1afc39083a0d17c59e7be8a5e0b2923465f58861e5a8357847bf01b8fd6b0f968d6daed1a52ea6b27aea2f327fc25855022dd489cbf8e4a0e0334e7c08d2e

  • \Windows\system\URnSQTz.exe

    Filesize

    5.7MB

    MD5

    2e1174464d9c3dfe641f5de81f931768

    SHA1

    f163c64b6a9bbc8d1ed1e42686d1a0f77314a92a

    SHA256

    1fef1238179c32397814df5d1590928f4018a2f9250b7d7f17800aee903cfd0f

    SHA512

    1a4e5d9eb5402a1ec7c5b89e279757f35498daa2d36449203e2e498e3b7b1c2025aaec61cfe46b518dbfd74529b6ad03b1e318821d784e62ac6a4f98ad92b8d2

  • \Windows\system\VZprGAw.exe

    Filesize

    5.7MB

    MD5

    530bbd91054a1a1939db48aa0dbe4a33

    SHA1

    6e0a279a76cf984afa7826f9addc43ceb2a777f9

    SHA256

    698e6e7fb76ff38066031abbd693ee40cb29dfdd45b9f06d0c00cf2df6106ba5

    SHA512

    52f9c611d88aa610c1729f2b6aa2f5dcdee040c5f16f8e66b87cb18022c3ac5d09dc0417f5e5dafab092aeb15fcf15de1de0903c6439c08b2d5fbb3afea0c3bd

  • \Windows\system\WFHFNVt.exe

    Filesize

    5.7MB

    MD5

    3c511338895f8c9279fea096ffc0144e

    SHA1

    a1cfb479a8eec487ad8869abfce9c2512b39d9c8

    SHA256

    d0195703343f09e4f393a695d8e94f06738de4760164b9a249ecd6c505fb0892

    SHA512

    da5317d6d24bf5f6c736f339640ac870992852c847e4dd693f36be507bf9eb54efe21166f6f50c5952a39779d1788513481e8c4bdca494c80c66fb0c63a00d5c

  • \Windows\system\YgEFayI.exe

    Filesize

    5.7MB

    MD5

    6d7017ad2256310658489d5cca854be2

    SHA1

    94446a50bcfdc28549872a1a6979302ce19c5bc7

    SHA256

    fcfdda7e8f65f484aea04537b92aa6efa69151963ae10dc9f7bbcfdd9f834f49

    SHA512

    08959b943e7da2dd1a2ad072aae0c02c9cb8f38d4f9c405946471d26b63078995f974e61725cac404472d4db2a704f190e0b23f95ded264a0c566121a3d9df9f

  • \Windows\system\njHXYeC.exe

    Filesize

    5.7MB

    MD5

    8d382fc84fba1ca20c58de487b27742e

    SHA1

    92be67deea5b55f9bf797fab09f07ebd12d48de9

    SHA256

    f6e3db2a65e579cfb67469bc1cb0bcd9dea3f600e6d6e25b880f664d2a39648d

    SHA512

    02064d1e091ef5be44bcfd589bfaf2ad747f6af649ae9aa0df5b9138efd06d12a0f065cec875085547167ba330ef157443beeb2e9758ecaa382f9b9fab148bf5

  • memory/236-113-0x000000013F090000-0x000000013F3DD000-memory.dmp

    Filesize

    3.3MB

  • memory/560-95-0x000000013F080000-0x000000013F3CD000-memory.dmp

    Filesize

    3.3MB

  • memory/904-17-0x000000013F360000-0x000000013F6AD000-memory.dmp

    Filesize

    3.3MB

  • memory/1016-119-0x000000013F310000-0x000000013F65D000-memory.dmp

    Filesize

    3.3MB

  • memory/1144-107-0x000000013FCD0000-0x000000014001D000-memory.dmp

    Filesize

    3.3MB

  • memory/1224-89-0x000000013F440000-0x000000013F78D000-memory.dmp

    Filesize

    3.3MB

  • memory/1236-124-0x000000013F970000-0x000000013FCBD000-memory.dmp

    Filesize

    3.3MB

  • memory/1980-101-0x000000013FB80000-0x000000013FECD000-memory.dmp

    Filesize

    3.3MB

  • memory/2000-14-0x000000013FBB0000-0x000000013FEFD000-memory.dmp

    Filesize

    3.3MB

  • memory/2056-7-0x000000013FA70000-0x000000013FDBD000-memory.dmp

    Filesize

    3.3MB

  • memory/2132-35-0x000000013F240000-0x000000013F58D000-memory.dmp

    Filesize

    3.3MB

  • memory/2440-25-0x000000013F5B0000-0x000000013F8FD000-memory.dmp

    Filesize

    3.3MB

  • memory/2604-65-0x000000013FB40000-0x000000013FE8D000-memory.dmp

    Filesize

    3.3MB

  • memory/2616-83-0x000000013F630000-0x000000013F97D000-memory.dmp

    Filesize

    3.3MB

  • memory/2628-53-0x000000013F580000-0x000000013F8CD000-memory.dmp

    Filesize

    3.3MB

  • memory/2652-77-0x000000013F8E0000-0x000000013FC2D000-memory.dmp

    Filesize

    3.3MB

  • memory/2728-126-0x000000013FBD0000-0x000000013FF1D000-memory.dmp

    Filesize

    3.3MB

  • memory/2768-59-0x000000013F270000-0x000000013F5BD000-memory.dmp

    Filesize

    3.3MB

  • memory/2788-36-0x000000013FD00000-0x000000014004D000-memory.dmp

    Filesize

    3.3MB

  • memory/2884-47-0x000000013F960000-0x000000013FCAD000-memory.dmp

    Filesize

    3.3MB

  • memory/2988-0-0x000000013FE60000-0x00000001401AD000-memory.dmp

    Filesize

    3.3MB

  • memory/2988-1-0x00000000000F0000-0x0000000000100000-memory.dmp

    Filesize

    64KB