Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 02:53

General

  • Target

    fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe

  • Size

    1.9MB

  • MD5

    541a9d3031657ebc794dc43a70511384

  • SHA1

    1c18826b93532c58a2a20ac1061e4309e7441867

  • SHA256

    fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533

  • SHA512

    fd3df8395904bad5ab23ebc1ac21febac8a55ebfe390039cba6b35d47c41963e91cc17f6c2144b024dc1d100528beec5ab6ee337b8181fb7c6630c6fef5e3c22

  • SSDEEP

    24576:s7USn+9Co5+54pIbtNSPouMVMOU93aBOR/UCtN0FSrSOdJw1EgfqBhR5OMqj6oxq:8qIZuMCso1U6Tda1lAeMsynjCM5x6

Malware Config

Signatures

  • Detect ZGRat V1 2 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects executables packed with unregistered version of .NET Reactor 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe
    "C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4604
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2284
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4412
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:828
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\lsass.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\dllhost.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1560
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\spoolsv.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1472
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3200
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\02aXpbHLU6.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:5684
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • Runs ping.exe
          PID:6108
        • C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe
          "C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5888
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\lsass.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:872
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4832
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2652
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4472
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:5100
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1868
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4760
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3876
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4688
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\odt\spoolsv.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:5040
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4744
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2028
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1596
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3508
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4940
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1880
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2144
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\lsass.exe

      Filesize

      1.9MB

      MD5

      541a9d3031657ebc794dc43a70511384

      SHA1

      1c18826b93532c58a2a20ac1061e4309e7441867

      SHA256

      fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533

      SHA512

      fd3df8395904bad5ab23ebc1ac21febac8a55ebfe390039cba6b35d47c41963e91cc17f6c2144b024dc1d100528beec5ab6ee337b8181fb7c6630c6fef5e3c22

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe.log

      Filesize

      1KB

      MD5

      cb4338b342d00bfe6111ffee5cbfc2ed

      SHA1

      fc16673b6833ad3cb00743a32868b859e90aa536

      SHA256

      343ed6661687e81c9615dcaea42fb1a98b70572bb9fe07e16f020108725dbbe9

      SHA512

      4bcea1366b8be00d08eb15cfd78c87e1c8f3aea140a4ea30efb3c0511cd3de21b7ce8c933c7478fb06a356573ecb928e50df23d340fbd9a6e6c156a004d2a77a

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      e448fe0d240184c6597a31d3be2ced58

      SHA1

      372b8d8c19246d3e38cd3ba123cc0f56070f03cd

      SHA256

      c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

      SHA512

      0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      a8e8360d573a4ff072dcc6f09d992c88

      SHA1

      3446774433ceaf0b400073914facab11b98b6807

      SHA256

      bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

      SHA512

      4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      e8ce785f8ccc6d202d56fefc59764945

      SHA1

      ca032c62ddc5e0f26d84eff9895eb87f14e15960

      SHA256

      d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

      SHA512

      66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      588e5b3406537204588ef39f4c84259f

      SHA1

      c6056b8139c0796cc6272b7b71fca2085f62b785

      SHA256

      3b7e7c56deb0f16483d67e60a42a5f0a58ee557790fe0f312d036e4ecc31f7f0

      SHA512

      f85ea8f8f0c3ea56840a84f42a188f125c13cea8b23f86ddcce8eb28758e816dd6d871154dfe63d250ef369b153f72c587a7a8bccd0a2728b7bc922dd7436e96

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      e243a38635ff9a06c87c2a61a2200656

      SHA1

      ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

      SHA256

      af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

      SHA512

      4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      aaaac7c68d2b7997ed502c26fd9f65c2

      SHA1

      7c5a3731300d672bf53c43e2f9e951c745f7fbdf

      SHA256

      8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

      SHA512

      c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

    • C:\Users\Admin\AppData\Local\Temp\02aXpbHLU6.bat

      Filesize

      218B

      MD5

      a7756cb55e16d659278e3cdaea3202f0

      SHA1

      3aeb7f0bfbfe9302dc454c184811254871469e91

      SHA256

      d7edcd05f3883ee36ff6629a205d73738fa71bfa38821b363502eab2973b5900

      SHA512

      4ee4c7a06761dde7817b03f06315f5aa709ded5ea2285d3c546fa351c6c435284da53d35e59d2ca9fbf0f8f96e38309eb8c29dfb266ab539095b85fcdb6f0d17

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upyrby13.xhb.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/828-242-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/1084-229-0x0000018657740000-0x0000018657750000-memory.dmp

      Filesize

      64KB

    • memory/1084-245-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/1472-230-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/1560-243-0x000002354D630000-0x000002354D640000-memory.dmp

      Filesize

      64KB

    • memory/1560-50-0x000002354D630000-0x000002354D640000-memory.dmp

      Filesize

      64KB

    • memory/1560-48-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2284-225-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2284-227-0x000002DAF9E50000-0x000002DAF9E60000-memory.dmp

      Filesize

      64KB

    • memory/2452-241-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2516-213-0x000001A4FF310000-0x000001A4FF320000-memory.dmp

      Filesize

      64KB

    • memory/2516-212-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2516-214-0x000001A4FF310000-0x000001A4FF320000-memory.dmp

      Filesize

      64KB

    • memory/2672-6-0x00007FFE4A550000-0x00007FFE4A551000-memory.dmp

      Filesize

      4KB

    • memory/2672-10-0x0000000002AE0000-0x0000000002AFC000-memory.dmp

      Filesize

      112KB

    • memory/2672-25-0x000000001B770000-0x000000001B780000-memory.dmp

      Filesize

      64KB

    • memory/2672-24-0x0000000002B20000-0x0000000002B2C000-memory.dmp

      Filesize

      48KB

    • memory/2672-49-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2672-22-0x00007FFE4A510000-0x00007FFE4A511000-memory.dmp

      Filesize

      4KB

    • memory/2672-19-0x00007FFE4A520000-0x00007FFE4A521000-memory.dmp

      Filesize

      4KB

    • memory/2672-21-0x0000000002AD0000-0x0000000002AD8000-memory.dmp

      Filesize

      32KB

    • memory/2672-18-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2672-17-0x0000000002AC0000-0x0000000002ACC000-memory.dmp

      Filesize

      48KB

    • memory/2672-15-0x00007FFE4A530000-0x00007FFE4A531000-memory.dmp

      Filesize

      4KB

    • memory/2672-14-0x0000000002B00000-0x0000000002B18000-memory.dmp

      Filesize

      96KB

    • memory/2672-12-0x000000001B980000-0x000000001B9D0000-memory.dmp

      Filesize

      320KB

    • memory/2672-0-0x00000000007B0000-0x0000000000996000-memory.dmp

      Filesize

      1.9MB

    • memory/2672-47-0x00007FFE4A9F0000-0x00007FFE4AAAE000-memory.dmp

      Filesize

      760KB

    • memory/2672-1-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2672-38-0x000000001B770000-0x000000001B780000-memory.dmp

      Filesize

      64KB

    • memory/2672-43-0x00007FFE4A9F0000-0x00007FFE4AAAE000-memory.dmp

      Filesize

      760KB

    • memory/2672-2-0x000000001B770000-0x000000001B780000-memory.dmp

      Filesize

      64KB

    • memory/2672-11-0x00007FFE4A540000-0x00007FFE4A541000-memory.dmp

      Filesize

      4KB

    • memory/2672-26-0x00007FFE4A500000-0x00007FFE4A501000-memory.dmp

      Filesize

      4KB

    • memory/2672-8-0x000000001B770000-0x000000001B780000-memory.dmp

      Filesize

      64KB

    • memory/2672-3-0x0000000001130000-0x0000000001131000-memory.dmp

      Filesize

      4KB

    • memory/2672-7-0x00000000011C0000-0x00000000011CE000-memory.dmp

      Filesize

      56KB

    • memory/2672-4-0x00007FFE4A9F0000-0x00007FFE4AAAE000-memory.dmp

      Filesize

      760KB

    • memory/2744-236-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2744-239-0x00000196BBAD0000-0x00000196BBAE0000-memory.dmp

      Filesize

      64KB

    • memory/2796-246-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-248-0x0000025EE9E60000-0x0000025EE9E70000-memory.dmp

      Filesize

      64KB

    • memory/2796-247-0x0000025EE9E60000-0x0000025EE9E70000-memory.dmp

      Filesize

      64KB

    • memory/3104-238-0x0000013453C70000-0x0000013453C80000-memory.dmp

      Filesize

      64KB

    • memory/3104-237-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/3104-244-0x0000013453C70000-0x0000013453C80000-memory.dmp

      Filesize

      64KB

    • memory/3200-228-0x000001F05F020000-0x000001F05F030000-memory.dmp

      Filesize

      64KB

    • memory/3200-224-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/3396-51-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/3396-59-0x0000020CDE720000-0x0000020CDE730000-memory.dmp

      Filesize

      64KB

    • memory/3988-181-0x0000029F3EC20000-0x0000029F3EC30000-memory.dmp

      Filesize

      64KB

    • memory/3988-152-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/4064-53-0x00000217AA190000-0x00000217AA1B2000-memory.dmp

      Filesize

      136KB

    • memory/4064-45-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/4064-240-0x00000217AA180000-0x00000217AA190000-memory.dmp

      Filesize

      64KB

    • memory/4064-46-0x00000217AA180000-0x00000217AA190000-memory.dmp

      Filesize

      64KB

    • memory/4372-232-0x00000211B9B80000-0x00000211B9B90000-memory.dmp

      Filesize

      64KB

    • memory/4372-231-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/4412-72-0x000001D4687D0000-0x000001D4687E0000-memory.dmp

      Filesize

      64KB

    • memory/4412-52-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/4604-235-0x00000282D09D0000-0x00000282D09E0000-memory.dmp

      Filesize

      64KB

    • memory/4604-233-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB

    • memory/4604-234-0x00000282D09D0000-0x00000282D09E0000-memory.dmp

      Filesize

      64KB

    • memory/5076-101-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmp

      Filesize

      10.8MB