Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    13/07/2020, 18:28

General

  • Target

    https://agenziaviesse-my.sharepoint.com/:o:/g/personal/federico_agenziaviesse_onmicrosoft_com/EkkOCk0G2XRJjSiMKoBup40B9edXAX5OAWfT8Bmi0JjTFQ?e=36ya4E

  • Sample

    200713-s76p1eblx6

Score
7/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 127 IoCs
  • Modifies system certificate store 8 IoCs
  • Drops Chrome extension 3 IoCs
  • Checks whether UAC is enabled 3 IoCs
  • Suspicious use of WriteProcessMemory 828 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SendNotifyMessage 24 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://agenziaviesse-my.sharepoint.com/:o:/g/personal/federico_agenziaviesse_onmicrosoft_com/EkkOCk0G2XRJjSiMKoBup40B9edXAX5OAWfT8Bmi0JjTFQ?e=36ya4E
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      PID:508
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:82958 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      PID:2540
  • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious behavior: EnumeratesProcesses
    • Drops Chrome extension
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SendNotifyMessage
    PID:2072
    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xb4,0xb8,0xbc,0x90,0xc0,0x7ffcb56fbd28,0x7ffcb56fbd38,0x7ffcb56fbd48
      2⤵
        PID:3012
      • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1996 --on-initialized-event-handle=616 --parent-handle=620 /prefetch:6
        2⤵
          PID:3972
        • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
          "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1476 --ignored=" --type=renderer " /prefetch:2
          2⤵
            PID:3848
          • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
            "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1680 /prefetch:8
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1672
          • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
            "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
            2⤵
              PID:1188
            • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --instant-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
              2⤵
                PID:1608
              • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3448 --ignored=" --type=renderer " /prefetch:8
                2⤵
                  PID:4336
                • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3584 --ignored=" --type=renderer " /prefetch:8
                  2⤵
                    PID:4348
                  • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3720 --ignored=" --type=renderer " /prefetch:8
                    2⤵
                      PID:4368
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
                      2⤵
                        PID:4452
                      • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                        2⤵
                          PID:4528
                        • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                          "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=2684 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4756
                        • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                          "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2812 --ignored=" --type=renderer " /prefetch:8
                          2⤵
                            PID:4816
                          • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                            "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4092 --ignored=" --type=renderer " /prefetch:8
                            2⤵
                              PID:4856
                            • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                              "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4084 --ignored=" --type=renderer " /prefetch:8
                              2⤵
                                PID:4892
                              • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3736 --ignored=" --type=renderer " /prefetch:8
                                2⤵
                                  PID:4928
                                • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4348 --ignored=" --type=renderer " /prefetch:8
                                  2⤵
                                    PID:4968
                                  • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=3684 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5004
                                  • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
                                    2⤵
                                      PID:5016
                                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3636 --ignored=" --type=renderer " /prefetch:8
                                      2⤵
                                        PID:4292
                                      • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4528 --ignored=" --type=renderer " /prefetch:8
                                        2⤵
                                          PID:4416
                                        • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4320 --ignored=" --type=renderer " /prefetch:8
                                          2⤵
                                            PID:4360
                                          • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4628 --ignored=" --type=renderer " /prefetch:8
                                            2⤵
                                              PID:4368
                                            • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
                                              2⤵
                                                PID:4572
                                              • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=2360 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4296
                                              • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1460,9447161550088028007,15932993880913816001,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=4080 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2456

                                            Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/1188-40-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-49-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-65-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-64-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-63-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-24-0x0000370900040000-0x0000370900041000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1188-62-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-61-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-27-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-28-0x0000020515BF0000-0x0000020515BF1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1188-29-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-30-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-31-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-32-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-33-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-34-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-35-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-36-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-37-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-38-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-39-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-60-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-41-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-42-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-43-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-44-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-45-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-46-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-47-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-48-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-59-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-50-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-51-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-52-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-53-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-54-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-55-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-56-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-57-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1188-58-0x0000020513AD0000-0x0000020513AD00F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/1608-26-0x000002A682090000-0x000002A682091000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1608-25-0x000075CB00040000-0x000075CB00041000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2072-125-0x000002008B5F0000-0x000002008B5F1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/3848-18-0x00007FFCD0850000-0x00007FFCD0851000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4452-78-0x000001AA020C0000-0x000001AA020C1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4452-77-0x000045AC00040000-0x000045AC00041000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4528-112-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-85-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-89-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-90-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-91-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-92-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-93-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-94-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-95-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-96-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-97-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-98-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-99-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-100-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-101-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-102-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-103-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-104-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-105-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-106-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-107-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-108-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-109-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-110-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-111-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-87-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-113-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-114-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-115-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-116-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-117-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-118-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-119-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-120-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-81-0x0000451400040000-0x0000451400041000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4528-86-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-88-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-82-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4528-83-0x00000120304D0000-0x00000120304D1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4528-84-0x000001202E470000-0x000001202E4700F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-207-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-219-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-195-0x00001D1400040000-0x00001D1400041000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4572-199-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-237-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-236-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-235-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-234-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-233-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-232-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-231-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-230-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-229-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-228-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-227-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-226-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-225-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-224-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-223-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-222-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-221-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-220-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-218-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-217-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-216-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-215-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-214-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-213-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-212-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-211-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-210-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-209-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-208-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-200-0x00000227F7EE0000-0x00000227F7EE1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4572-206-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-205-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-204-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-203-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-202-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/4572-201-0x00000227F5A80000-0x00000227F5A800F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-158-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-156-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-175-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-174-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-173-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-172-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-171-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-170-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-169-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-164-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-168-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-167-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-166-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-165-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-163-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-162-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-161-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-160-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-159-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-176-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-155-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-157-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-154-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-153-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-152-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-151-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-150-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-149-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-148-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-147-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-146-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-145-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-144-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-143-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-142-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-141-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-140-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-139-0x0000016A24B80000-0x0000016A24B81000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/5016-138-0x0000016A22B40000-0x0000016A22B400F8-memory.dmp

                                              Filesize

                                              248B

                                            • memory/5016-137-0x0000424F00040000-0x0000424F00041000-memory.dmp

                                              Filesize

                                              4KB