Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    159s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/03/2024, 03:55

General

  • Target

    58a33e0f77235b76006f2d94b21377c3c259afc612cd44df0d707d70645cc194.exe

  • Size

    1.8MB

  • MD5

    98a30293d97ff1b2f0ce8daaded19581

  • SHA1

    1df329a7a3b12c7e3ec9a7c1906be6db82c1aa8e

  • SHA256

    58a33e0f77235b76006f2d94b21377c3c259afc612cd44df0d707d70645cc194

  • SHA512

    fea45608c22986e814154c98a6ee30b3a99360e337d7bb3c3d344a36a4d89d756dc68ffa3d60152fd3f1e63f9fa4ef1ac8b0d5193648f3781a49dce4a47e6de7

  • SSDEEP

    24576:hHp1iKHep8p+qTwp07IXRMGIyOpL5aaNPGlUN1Z9cnywODwkE2fqPva:8KK8pHTw27GfIyOpNa6rSyDPE5

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.185.137.132:1632

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32
rc4.i32

Extracted

Family

amadey

Version

4.12

C2

http://185.172.128.19

Attributes
  • install_dir

    cd1f156d67

  • install_file

    Utsysc.exe

  • strings_key

    0dd3e5ee91b367c60c9e575983554b30

  • url_paths

    /ghsdh39s/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 4 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\58a33e0f77235b76006f2d94b21377c3c259afc612cd44df0d707d70645cc194.exe
    "C:\Users\Admin\AppData\Local\Temp\58a33e0f77235b76006f2d94b21377c3c259afc612cd44df0d707d70645cc194.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:5048
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe
      "C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:892
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3996
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2744
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:408
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            4⤵
              PID:1296
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\852399462405_Desktop.zip' -CompressionLevel Optimal
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4524
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
          2⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:4628
        • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
          "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4152
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4944
            • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1620
            • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
              4⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:2192
        • C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe
          "C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe"
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2176
        • C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe
          "C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"
          2⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3692
        • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
          "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe" /F
            3⤵
            • Creates scheduled task(s)
            PID:2440
      • C:\Users\Admin\AppData\Local\Temp\E5F1.exe
        C:\Users\Admin\AppData\Local\Temp\E5F1.exe
        1⤵
        • Executes dropped EXE
        PID:4180

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

        Filesize

        1.5MB

        MD5

        82ae85d0c46b902ee2d95fe080ee2762

        SHA1

        f92e89b7e15af87ea9eb97863ba0c5684465e581

        SHA256

        8594f071760cc3b70dd0e5fe0eceab41fd52e4dbb8dabec7bf30f6982c6a66b4

        SHA512

        0ce22120c170597df6299b59ca55a3ac009d88eda91837a4b1c7f505f22cd041360308d79c1dd78309a488ef1a16356fbedbb91ee1a95cbc2d1468de0dd102fc

      • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

        Filesize

        832KB

        MD5

        c714f2755e9fcd72bffb4f33838efbe2

        SHA1

        da86c2e2ae671f2fda40673dcca1c981fe93a901

        SHA256

        41d8ff86f0cc50d10dcf66e328604dd9303c69acda3616fc208f771cb9a2845a

        SHA512

        08161ab644e627b2cfc3940f2b6384c5cde73eef6230f58b9e634472b39e92490f44b353f0b4ab97e4e85768cd4d91cc4a2bada1388ac64831ea4cdd78f7cab7

      • C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe

        Filesize

        162B

        MD5

        1b7c22a214949975556626d7217e9a39

        SHA1

        d01c97e2944166ed23e47e4a62ff471ab8fa031f

        SHA256

        340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

        SHA512

        ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

      • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe

        Filesize

        464KB

        MD5

        c084d6f6ba40534fbfc5a64b21ef99ab

        SHA1

        0b4a17da83c0a8abbc8fab321931d5447b32b720

        SHA256

        afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

        SHA512

        a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

      • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe

        Filesize

        1.7MB

        MD5

        85a15f080b09acace350ab30460c8996

        SHA1

        3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

        SHA256

        3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

        SHA512

        ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

      • C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe

        Filesize

        315KB

        MD5

        5fe67781ffe47ec36f91991abf707432

        SHA1

        137e6d50387a837bf929b0da70ab6b1512e95466

        SHA256

        a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9

        SHA512

        0e32d9a72b562d4c4a8c4edbd3d0ece54b67ee87c8ac382c6508c62b04b11a2dcd1fba23c3a78004fcd0c2b623dc854fd2fd82eb372dc7becdcbdd7ec7fe1b68

      • C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe

        Filesize

        413KB

        MD5

        d467222c3bd563cb72fa49302f80b079

        SHA1

        9335e2a36abb8309d8a2075faf78d66b968b2a91

        SHA256

        fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

        SHA512

        484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

      • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka111.exe

        Filesize

        1KB

        MD5

        5343c1a8b203c162a3bf3870d9f50fd4

        SHA1

        04b5b886c20d88b57eea6d8ff882624a4ac1e51d

        SHA256

        dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

        SHA512

        e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949

      • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe

        Filesize

        418KB

        MD5

        0099a99f5ffb3c3ae78af0084136fab3

        SHA1

        0205a065728a9ec1133e8a372b1e3864df776e8c

        SHA256

        919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

        SHA512

        5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

      • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe

        Filesize

        192KB

        MD5

        822bb7b291c2cd31b60550759333a3f5

        SHA1

        381b6ddc0a48a736a0e65da27c9b2cf3da6e6986

        SHA256

        c12798a6710b88bfdebbd5a1061a5f059453959de215aabca0dbc412862a362e

        SHA512

        7c792ef5a8207c0a24a7af01e0f9a8482a31468475ac7a7d89e5891d68efb92cd31a2b1ff2376a2a52c07d515fb7d6a1ed8e99df9864322b355e5d3b81f5c00a

      • C:\Users\Admin\AppData\Local\Temp\E5F1.exe

        Filesize

        2.3MB

        MD5

        038f01c7ab34d20394b657ce5d5f3152

        SHA1

        7f82fb84c6c0aff1012675d48ba95b0558d3230f

        SHA256

        28119987147a63910d12662c2008089f85571817695dcd443d02303d52479c55

        SHA512

        4e0e25bfabb8882b58341205ee60f3f5dd83a9b93518aa3badd433b784531244fcc9bb07981461a6a382dbd2d1c4de211731156f8768f7cc8e61e0a7c0689a86

      • C:\Users\Admin\AppData\Local\Temp\Tmp234D.tmp

        Filesize

        2KB

        MD5

        1420d30f964eac2c85b2ccfe968eebce

        SHA1

        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

        SHA256

        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

        SHA512

        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3opt4rb.mdw.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

        Filesize

        109KB

        MD5

        2afdbe3b99a4736083066a13e4b5d11a

        SHA1

        4d4856cf02b3123ac16e63d4a448cdbcb1633546

        SHA256

        8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

        SHA512

        d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

        Filesize

        1.2MB

        MD5

        92fbdfccf6a63acef2743631d16652a7

        SHA1

        971968b1378dd89d59d7f84bf92f16fc68664506

        SHA256

        b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

        SHA512

        b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

      • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe

        Filesize

        541KB

        MD5

        1fc4b9014855e9238a361046cfbf6d66

        SHA1

        c17f18c8246026c9979ab595392a14fe65cc5e9f

        SHA256

        f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

        SHA512

        2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

      • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe

        Filesize

        304KB

        MD5

        cc90e3326d7b20a33f8037b9aab238e4

        SHA1

        236d173a6ac462d85de4e866439634db3b9eeba3

        SHA256

        bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

        SHA512

        b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

      • memory/892-67-0x0000000005150000-0x0000000005160000-memory.dmp

        Filesize

        64KB

      • memory/892-66-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/892-65-0x0000000000540000-0x00000000005BA000-memory.dmp

        Filesize

        488KB

      • memory/892-75-0x0000000002B40000-0x0000000004B40000-memory.dmp

        Filesize

        32.0MB

      • memory/892-74-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/892-126-0x0000000002B40000-0x0000000004B40000-memory.dmp

        Filesize

        32.0MB

      • memory/2176-248-0x0000000000400000-0x0000000002D4D000-memory.dmp

        Filesize

        41.3MB

      • memory/2192-193-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/2192-192-0x0000000000D10000-0x0000000000D62000-memory.dmp

        Filesize

        328KB

      • memory/2192-212-0x0000000006250000-0x00000000062C6000-memory.dmp

        Filesize

        472KB

      • memory/2192-196-0x0000000005800000-0x0000000005810000-memory.dmp

        Filesize

        64KB

      • memory/2744-76-0x0000000005090000-0x0000000005122000-memory.dmp

        Filesize

        584KB

      • memory/2744-101-0x00000000087C0000-0x0000000008826000-memory.dmp

        Filesize

        408KB

      • memory/2744-139-0x0000000009730000-0x0000000009780000-memory.dmp

        Filesize

        320KB

      • memory/2744-70-0x0000000000400000-0x0000000000450000-memory.dmp

        Filesize

        320KB

      • memory/2744-73-0x00000000055A0000-0x0000000005B46000-memory.dmp

        Filesize

        5.6MB

      • memory/2744-86-0x0000000006510000-0x000000000654C000-memory.dmp

        Filesize

        240KB

      • memory/2744-138-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/2744-134-0x00000000097B0000-0x0000000009972000-memory.dmp

        Filesize

        1.8MB

      • memory/2744-77-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/2744-158-0x0000000005270000-0x0000000005280000-memory.dmp

        Filesize

        64KB

      • memory/2744-79-0x0000000005080000-0x000000000508A000-memory.dmp

        Filesize

        40KB

      • memory/2744-80-0x0000000005270000-0x0000000005280000-memory.dmp

        Filesize

        64KB

      • memory/2744-81-0x0000000006670000-0x0000000006C88000-memory.dmp

        Filesize

        6.1MB

      • memory/2744-136-0x0000000009EB0000-0x000000000A3DC000-memory.dmp

        Filesize

        5.2MB

      • memory/2744-83-0x0000000007E30000-0x0000000007F3A000-memory.dmp

        Filesize

        1.0MB

      • memory/2744-84-0x0000000006460000-0x0000000006472000-memory.dmp

        Filesize

        72KB

      • memory/2744-87-0x0000000006550000-0x000000000659C000-memory.dmp

        Filesize

        304KB

      • memory/3088-29-0x0000000005130000-0x0000000005131000-memory.dmp

        Filesize

        4KB

      • memory/3088-26-0x00000000050D0000-0x00000000050D1000-memory.dmp

        Filesize

        4KB

      • memory/3088-82-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-100-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-78-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-28-0x0000000005140000-0x0000000005141000-memory.dmp

        Filesize

        4KB

      • memory/3088-19-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-321-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-319-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-123-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-310-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-296-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-27-0x0000000005110000-0x0000000005111000-memory.dmp

        Filesize

        4KB

      • memory/3088-85-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-250-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-20-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-242-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-25-0x00000000050C0000-0x00000000050C1000-memory.dmp

        Filesize

        4KB

      • memory/3088-137-0x0000000000680000-0x0000000000B18000-memory.dmp

        Filesize

        4.6MB

      • memory/3088-24-0x0000000005120000-0x0000000005121000-memory.dmp

        Filesize

        4KB

      • memory/3088-23-0x00000000050E0000-0x00000000050E1000-memory.dmp

        Filesize

        4KB

      • memory/3088-22-0x0000000005100000-0x0000000005101000-memory.dmp

        Filesize

        4KB

      • memory/3088-21-0x00000000050F0000-0x00000000050F1000-memory.dmp

        Filesize

        4KB

      • memory/3316-246-0x00000000045E0000-0x00000000045F6000-memory.dmp

        Filesize

        88KB

      • memory/4152-160-0x0000000000C70000-0x0000000000E2C000-memory.dmp

        Filesize

        1.7MB

      • memory/4152-161-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/4152-162-0x00000000057A0000-0x00000000057B0000-memory.dmp

        Filesize

        64KB

      • memory/4152-170-0x00000000032C0000-0x00000000052C0000-memory.dmp

        Filesize

        32.0MB

      • memory/4152-171-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/4180-325-0x0000000000E00000-0x0000000001197000-memory.dmp

        Filesize

        3.6MB

      • memory/4524-128-0x00000210F8CD0000-0x00000210F8CDA000-memory.dmp

        Filesize

        40KB

      • memory/4524-125-0x00000210F8CE0000-0x00000210F8CF0000-memory.dmp

        Filesize

        64KB

      • memory/4524-113-0x00000210F8CF0000-0x00000210F8D12000-memory.dmp

        Filesize

        136KB

      • memory/4524-122-0x00007FF839230000-0x00007FF839CF2000-memory.dmp

        Filesize

        10.8MB

      • memory/4524-124-0x00000210F8CE0000-0x00000210F8CF0000-memory.dmp

        Filesize

        64KB

      • memory/4524-127-0x00000210F8F60000-0x00000210F8F72000-memory.dmp

        Filesize

        72KB

      • memory/4524-135-0x00007FF839230000-0x00007FF839CF2000-memory.dmp

        Filesize

        10.8MB

      • memory/4944-172-0x0000000073750000-0x0000000073F01000-memory.dmp

        Filesize

        7.7MB

      • memory/4944-165-0x0000000000400000-0x0000000000592000-memory.dmp

        Filesize

        1.6MB

      • memory/5048-6-0x0000000004C10000-0x0000000004C11000-memory.dmp

        Filesize

        4KB

      • memory/5048-7-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

        Filesize

        4KB

      • memory/5048-9-0x0000000004C00000-0x0000000004C01000-memory.dmp

        Filesize

        4KB

      • memory/5048-3-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

        Filesize

        4KB

      • memory/5048-4-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

        Filesize

        4KB

      • memory/5048-5-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

        Filesize

        4KB

      • memory/5048-2-0x0000000000230000-0x00000000006C8000-memory.dmp

        Filesize

        4.6MB

      • memory/5048-8-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

        Filesize

        4KB

      • memory/5048-10-0x0000000004C30000-0x0000000004C31000-memory.dmp

        Filesize

        4KB

      • memory/5048-11-0x0000000004C20000-0x0000000004C21000-memory.dmp

        Filesize

        4KB

      • memory/5048-0-0x0000000000230000-0x00000000006C8000-memory.dmp

        Filesize

        4.6MB

      • memory/5048-1-0x0000000077D96000-0x0000000077D98000-memory.dmp

        Filesize

        8KB

      • memory/5048-16-0x0000000000230000-0x00000000006C8000-memory.dmp

        Filesize

        4.6MB