Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2024, 01:12

General

  • Target

    61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe

  • Size

    7.2MB

  • MD5

    5446af14bfb2bf63ec1b409a0752f2bb

  • SHA1

    2d0ed53f2bab261a09e50e35b95f896ddf6dd688

  • SHA256

    61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434

  • SHA512

    3f96ff6656d7937fe3be66688c5559a238be9e0277373dd8a325f2e36fbd50095285ae8da8db0b59f0706b9514bdf54f2f66da81caf4d2818b9c9d20d5cff436

  • SSDEEP

    49152:OSa5+lvH/3ehlWOU9Hl73KkPjOMVMC21gt9dmFF9KINW1FQr7qrzW+x30rY6yTK4:A0X3IWbXPjObC9CFAArmGm3U0KFK/j

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 32 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects executables packed with unregistered version of .NET Reactor 39 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe
    "C:\Users\Admin\AppData\Local\Temp\61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe
      "C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\AppData\Local\Temp\Logger.exe
        "C:\Users\Admin\AppData\Local\Temp\Logger.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Users\Admin\AppData\Local\Temp\1.exe
          "C:\Users\Admin\AppData\Local\Temp\1.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1156
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:5012
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:824
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1528
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4156
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2524
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1944
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3896
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\msedge.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4480
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4688
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3524
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4952
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mk9gQGmwZ5.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5308
            • C:\Windows\system32\chcp.com
              chcp 65001
              6⤵
                PID:5752
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                6⤵
                • Runs ping.exe
                PID:5720
              • C:\odt\unsecapp.exe
                "C:\odt\unsecapp.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5520
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1232
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1920
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4776
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4108
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3600
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4892
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2644
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\odt\unsecapp.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2344
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4640
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4756
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:60
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:708
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1360
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4516
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4728
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1188
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "11" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2284
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "1" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1136
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "11" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3872

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        d28a889fd956d5cb3accfbaf1143eb6f

        SHA1

        157ba54b365341f8ff06707d996b3635da8446f7

        SHA256

        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

        SHA512

        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        e8ce785f8ccc6d202d56fefc59764945

        SHA1

        ca032c62ddc5e0f26d84eff9895eb87f14e15960

        SHA256

        d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

        SHA512

        66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        aaaac7c68d2b7997ed502c26fd9f65c2

        SHA1

        7c5a3731300d672bf53c43e2f9e951c745f7fbdf

        SHA256

        8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

        SHA512

        c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        a8e8360d573a4ff072dcc6f09d992c88

        SHA1

        3446774433ceaf0b400073914facab11b98b6807

        SHA256

        bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

        SHA512

        4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        60804e808a88131a5452fed692914a8e

        SHA1

        fdb74669923b31d573787fe024dbd701fa21bb5b

        SHA256

        064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61

        SHA512

        d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        ecceac16628651c18879d836acfcb062

        SHA1

        420502b3e5220a01586c59504e94aa1ee11982c9

        SHA256

        58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

        SHA512

        be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

      • C:\Users\Admin\AppData\Local\Temp\1.exe

        Filesize

        6.3MB

        MD5

        4e2c3489ec26807d69f9171479886188

        SHA1

        40f8c57e6918d1626177810c6f1b5a65d9bf93d1

        SHA256

        33466d0c92e0fb64d98b89ca503976b86cfd5400c387aeb9dd66f096b4c14ca9

        SHA512

        0ed949039d77b4777f8da9ede1e245b22759fa2bd86ec90692c216263a27693264f926ad256336a8b4e2e688c05deb4790ba0a2799479213a9cb9960787f0d3e

      • C:\Users\Admin\AppData\Local\Temp\Logger.exe

        Filesize

        6.6MB

        MD5

        48bfaeb0285f1b090cbf09e2feb6ad10

        SHA1

        67d25ecce37f5a70ec950758351e81593b99ed05

        SHA256

        d8c19254251b41d6f815582ba4c018994cae3bdf3677e198a88138a43aaaf15e

        SHA512

        f8f19c480a72dcb1a88585a94c95767dfdaab0320aafd46f61309385fd9f7e68a8b392801ab243e7c545f43cd9e23366aa94814a05d9f9a0b604c22ab81ad08d

      • C:\Users\Admin\AppData\Local\Temp\Mk9gQGmwZ5.bat

        Filesize

        147B

        MD5

        710dcd1097713344551a8ebdd8ca517d

        SHA1

        c9c03562adaac741336e4cd5cf774872274ff28d

        SHA256

        565fc63d25b97a5b7b5ac6ddb0df1bb9a152f1cf2baa124de88433e13a189981

        SHA512

        c4b6b79e2c50c55a8824314bc39ee12686a0e42080f57aa5ffbcda7910c9a5c810c717ba401208ade9a792d63bb670e65c95ccb82219ca96955cbb81032d58d0

      • C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe

        Filesize

        6.9MB

        MD5

        d22490055518bbf8d44579a00453da46

        SHA1

        d738768635f9646c71b98befc3bf2a4c9f5c29e3

        SHA256

        ee2c37126091fa67a5b5abbf7ac2a4271514ec7620aef87b34d42e80c576cd0a

        SHA512

        ecdd5baf602b3e9e59f15b47ad3925026568be9fdf1d384cc3dbae2b292abbf1878cbd1f919cf680442c65a9299c3496d9f03fed8b8504ba34f805e5ef984f08

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pbyzamwd.ozc.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/2732-3594-0x000000001C580000-0x000000001C5A6000-memory.dmp

        Filesize

        152KB

      • memory/2732-3609-0x000000001C5E0000-0x000000001C5EE000-memory.dmp

        Filesize

        56KB

      • memory/2732-52-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-48-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-46-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-50-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-42-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-44-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-40-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-90-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-96-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-94-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-92-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-88-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-86-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-84-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-82-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-80-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-78-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-76-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-74-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-70-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-66-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-58-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-3596-0x0000000003090000-0x000000000309E000-memory.dmp

        Filesize

        56KB

      • memory/2732-3598-0x000000001C5B0000-0x000000001C5CC000-memory.dmp

        Filesize

        112KB

      • memory/2732-3599-0x000000001C620000-0x000000001C670000-memory.dmp

        Filesize

        320KB

      • memory/2732-3601-0x00000000030A0000-0x00000000030B0000-memory.dmp

        Filesize

        64KB

      • memory/2732-3603-0x000000001C5F0000-0x000000001C608000-memory.dmp

        Filesize

        96KB

      • memory/2732-3605-0x00000000030B0000-0x00000000030C0000-memory.dmp

        Filesize

        64KB

      • memory/2732-3607-0x000000001C5D0000-0x000000001C5E0000-memory.dmp

        Filesize

        64KB

      • memory/2732-54-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-3611-0x000000001C690000-0x000000001C6A2000-memory.dmp

        Filesize

        72KB

      • memory/2732-3613-0x000000001C610000-0x000000001C620000-memory.dmp

        Filesize

        64KB

      • memory/2732-3615-0x000000001C6B0000-0x000000001C6C6000-memory.dmp

        Filesize

        88KB

      • memory/2732-3617-0x000000001C6D0000-0x000000001C6E2000-memory.dmp

        Filesize

        72KB

      • memory/2732-3618-0x000000001CC20000-0x000000001D148000-memory.dmp

        Filesize

        5.2MB

      • memory/2732-3620-0x000000001C670000-0x000000001C67E000-memory.dmp

        Filesize

        56KB

      • memory/2732-3622-0x000000001C680000-0x000000001C690000-memory.dmp

        Filesize

        64KB

      • memory/2732-3624-0x000000001C6F0000-0x000000001C700000-memory.dmp

        Filesize

        64KB

      • memory/2732-3626-0x000000001C760000-0x000000001C7BA000-memory.dmp

        Filesize

        360KB

      • memory/2732-3628-0x000000001C700000-0x000000001C70E000-memory.dmp

        Filesize

        56KB

      • memory/2732-3630-0x000000001C710000-0x000000001C720000-memory.dmp

        Filesize

        64KB

      • memory/2732-3632-0x000000001C720000-0x000000001C72E000-memory.dmp

        Filesize

        56KB

      • memory/2732-3634-0x000000001C7C0000-0x000000001C7D8000-memory.dmp

        Filesize

        96KB

      • memory/2732-3636-0x000000001C730000-0x000000001C73C000-memory.dmp

        Filesize

        48KB

      • memory/2732-3638-0x000000001C830000-0x000000001C87E000-memory.dmp

        Filesize

        312KB

      • memory/2732-35-0x0000000000970000-0x0000000000FC0000-memory.dmp

        Filesize

        6.3MB

      • memory/2732-36-0x000000001BEA0000-0x000000001C22E000-memory.dmp

        Filesize

        3.6MB

      • memory/2732-37-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-60-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-62-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-64-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-68-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-72-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-56-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/2732-38-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

      • memory/3732-11-0x0000000000400000-0x0000000000B37000-memory.dmp

        Filesize

        7.2MB

      • memory/4236-23-0x0000000000400000-0x0000000000AF3000-memory.dmp

        Filesize

        6.9MB

      • memory/4688-3654-0x000002490F2E0000-0x000002490F302000-memory.dmp

        Filesize

        136KB

      • memory/4880-33-0x0000000000400000-0x0000000000A98000-memory.dmp

        Filesize

        6.6MB