Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2025, 14:05

General

  • Target

    http://staemcommunitly.com/gift/activation=Dor5Fhnm2w

Malware Config

Signatures

  • Detected potential entity reuse from brand STEAM. 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://staemcommunitly.com/gift/activation=Dor5Fhnm2w
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb171446f8,0x7ffb17144708,0x7ffb17144718
      2⤵
        PID:948
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
        2⤵
          PID:2852
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
          2⤵
          • Detected potential entity reuse from brand STEAM.
          • Suspicious behavior: EnumeratesProcesses
          PID:808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
          2⤵
            PID:3700
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
            2⤵
              PID:4532
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
              2⤵
                PID:4924
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
                2⤵
                  PID:888
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
                  2⤵
                    PID:2320
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3716
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5424 /prefetch:8
                    2⤵
                      PID:2848
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                      2⤵
                        PID:3352
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
                        2⤵
                          PID:1028
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
                          2⤵
                            PID:988
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
                            2⤵
                              PID:4280
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5272 /prefetch:8
                              2⤵
                                PID:2752
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                                2⤵
                                  PID:4036
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
                                  2⤵
                                    PID:1596
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                                    2⤵
                                      PID:3092
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6256 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3348
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3092
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:500
                                      • C:\Windows\system32\taskmgr.exe
                                        "C:\Windows\system32\taskmgr.exe" /4
                                        1⤵
                                        • Checks SCSI registry key(s)
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:2760

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        6960857d16aadfa79d36df8ebbf0e423

                                        SHA1

                                        e1db43bd478274366621a8c6497e270d46c6ed4f

                                        SHA256

                                        f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

                                        SHA512

                                        6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        f426165d1e5f7df1b7a3758c306cd4ae

                                        SHA1

                                        59ef728fbbb5c4197600f61daec48556fec651c1

                                        SHA256

                                        b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

                                        SHA512

                                        8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        408B

                                        MD5

                                        94b89f415aa886d86ea5cace9ad8e09c

                                        SHA1

                                        6ba17d77e6aa6e9bd24e9434520ead409fc2f3b5

                                        SHA256

                                        e4ea4ccf223edeb1ee4eb998c70b605482b67996381b58dd28adb5c1c55683d5

                                        SHA512

                                        96b48e7694e9543bfa235e3f1ea25fe8d3f741c1689ec05f79206027ab644fba2b45ea04f145ae7b1233ed5c31cd91d443e094ea7c5ac3707761dbb36d4b2d1f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        796B

                                        MD5

                                        802f1420e1b038d91d8bb1c16645278d

                                        SHA1

                                        a364dbc124b76cb4af4aa54083c48843ee4ab2dc

                                        SHA256

                                        a7e6c7c46c5811caa59d8e46c71f50c1661f78749f88f4afd6e0ce9fc657eab1

                                        SHA512

                                        2aaf8a7b6d17076454bb4b366dddf2e7f00d9b0e75ee1b9d96cb1b91b057bf8395881dc11123c02741f642bd5220f8c9866c420c6308fc320b463f5d848c3e75

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        8KB

                                        MD5

                                        bbf918daf1b9cbf4c15a84db669836c9

                                        SHA1

                                        2e228ea049fe584e9d0f31fa33ef042acfda2e74

                                        SHA256

                                        303c247a026c899aa2cdf0c19ee7ef4ea36a7846095a2a21b1cd72fec3fda7be

                                        SHA512

                                        e047944cd12e6088a30c47b18132b6861f9563626b975a5ff09abc42aba2ce7d7e9199a7561f6ab400dd4602b7f643e0bf98838263c3c10ba7709c9becc37dca

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        49a34a4495c9b51f892b02c256fabbef

                                        SHA1

                                        9eb47fe9a177b4786c100cde25fdd70d3f5f85ee

                                        SHA256

                                        151725a5f5c1dea4a9240bdb88b20d5a1bdba166e425e85d6b5b15a2189c6327

                                        SHA512

                                        a77ba7f314a2e7578ee373f22af2e5bd702b8fb72284af21e09c9c86dd52f9d748501e73139296822817a4f2b873ab4e32a80856167f148827864a08969e6e2b

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        eddc20f15bfd10467e09969020cc7753

                                        SHA1

                                        4202fab937456d3f6d2f427c70803a47f7e6b035

                                        SHA256

                                        4e22fd2e21d5afc2dc7c5e821db633d730e65f7be8663bd22e1d6a443ae4ca01

                                        SHA512

                                        287191492debc7a41f8918c979146861b38981b4d43ea2a02bf3d71d321b0c1bbaead308805d56a1d58e28ffa2dd54dcbe5559880a2df32d6bc6bb8145d37642

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        cb3fda7a5e9167ba68b53883c5215584

                                        SHA1

                                        8b1904c3ccdae71915684fe4083413a28bfe0eb4

                                        SHA256

                                        e99a2440e124accca9a5258bf6f7444e843c487cc9c15474464e1ca6b8d0486d

                                        SHA512

                                        7aed2183a8cc36af6ee7dfb037c432eaa4842c8c35bb98798cbd09df0c0492cd673c67ba99be8d3ba86ebfe9b5095db4f99f62ded64e0fe8dd6ee9b0945be512

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        24534203edf80acb18ff7a3f04a3c826

                                        SHA1

                                        443e5d45f2812b48c87cb474daadf756740eba83

                                        SHA256

                                        3e1c81ee8ce80bcd5e93a25e81d35d3b3dad10aa6fbc42cddb50a7ecd213e025

                                        SHA512

                                        db2b1b1ac43074d927c3d056e66224f33431e89ba98b8284167e0c989185c0e083ad84af8d3824fc63e3818c458830b7c7c92790fca6160157e8ab5d4b0f0dad

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        874B

                                        MD5

                                        47c6f272f3db209b489bb1007e90a41a

                                        SHA1

                                        7d95054a948bf47af08b732b5bfac36b51552ebc

                                        SHA256

                                        92082b8c10e351bc1f9dfac0acceb56bf0869bb52b4bdb8e12627cf4eca3dae2

                                        SHA512

                                        db1a460ae98946ce36f733a6db35dd2fe32f738fe6ccfd0274c93b2e02933a17cd52fbd9c749eed10846dc2614ae9799b378a5e3020d8a981493edc2e81238d2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594174.TMP

                                        Filesize

                                        874B

                                        MD5

                                        8605480d61ffe7b31d2ab0f5a351c943

                                        SHA1

                                        fdb7b0e05e1fd3e6594bae3d8dfc6a31dce1bf22

                                        SHA256

                                        e2f44ffb0fdfea0217efa1a738e18ff148cee758c9e5791b694f138205603efe

                                        SHA512

                                        431c2b4c5189a0f7084f9d778948c023d59b22989b21e43ed6730bc33a8976c1db455fc9c0cd5848936ca922b84b9b1f6abce6695603dffdbbbfdc9311023fac

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        10KB

                                        MD5

                                        bdd1bdf1573703d42d20543974429ab9

                                        SHA1

                                        43808223e17a938f4192139032683443101d89b4

                                        SHA256

                                        ac4596a1e15e8d34e4bf32bce8912a6da435757f42968dac0676d8ca686cd212

                                        SHA512

                                        4b030aaf2be5a703f91e0157e9df529d70a19c46c736c31d959fad6dba71f5397621c0a11af1d74ea4f5ea587b0c8e64d4c09b30dc4d875ba68e0399505385b1

                                      • memory/2760-178-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-175-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-174-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-173-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-172-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-176-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-177-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-167-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-168-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2760-166-0x0000024060830000-0x0000024060831000-memory.dmp

                                        Filesize

                                        4KB