Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 10:43

General

  • Target

    3a917279303107d5783913cd83efcc50N.exe

  • Size

    1.1MB

  • MD5

    3a917279303107d5783913cd83efcc50

  • SHA1

    9019344d64a050cab6b7acece195b37faf113325

  • SHA256

    68b496bddc667fb345436673fce70cf229a3beb186cc22aa1e3735b6640ea3ba

  • SHA512

    6781d8aa358b9c5563ac33259cbc143e228a78a7ff01ec358af4d92eec1c901692d5f7178462dfa6b983710b59a24e47b50258b0d2734e99639eb379dd0b531b

  • SSDEEP

    24576:p6eAYHwIMoEPbRjQFzRcp+BzbpWk/efbS2QKLOvRey2:p7QIMoEdsFCpopJwOCLOpx

Malware Config

Extracted

Family

remcos

Botnet

Host

C2

fnbabsa.net:3366

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-0MSACQ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a917279303107d5783913cd83efcc50N.exe
    "C:\Users\Admin\AppData\Local\Temp\3a917279303107d5783913cd83efcc50N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMwBhADkAMQA3ADIANwA5ADMAMAAzADEAMAA3AGQANQA3ADgAMwA5ADEAMwBjAGQAOAAzAGUAZgBjAGMANQAwAE4ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgADMAYQA5ADEANwAyADcAOQAzADAAMwAxADAANwBkADUANwA4ADMAOQAxADMAYwBkADgAMwBlAGYAYwBjADUAMABOAC4AZQB4AGUAOwA=
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "https://www.google.com"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3956
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:440
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd373846f8,0x7ffd37384708,0x7ffd37384718
          4⤵
            PID:4732
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
            4⤵
              PID:3532
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2288
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
              4⤵
                PID:4700
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                4⤵
                  PID:1884
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                  4⤵
                    PID:1908
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                    4⤵
                      PID:1036
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
                      4⤵
                        PID:1160
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4568
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                        4⤵
                          PID:3580
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                          4⤵
                            PID:1888
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                            4⤵
                              PID:3620
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1621244711143584447,2857954093185608182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                              4⤵
                                PID:4296
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SetWindowsHookEx
                            PID:3652
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1756
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3348

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\ProgramData\remcos\logs.dat

                              Filesize

                              144B

                              MD5

                              7c2fdf5ae76d7030055fd6947e435b4d

                              SHA1

                              51f681fd497c62e600025721a6864e4a73100a1f

                              SHA256

                              1e893703b72aa7d583d6bf66ee667889eb30f9d916358938dd7834a0b4c81991

                              SHA512

                              89fbf8a78b06d00acd051b83271517a0324ceb13f275bced4738980bc8ac9af41c418ff39c657e48309d1cd4e82e8f79aef4eac0b1623bf9b7ac03f5883defa8

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                              Filesize

                              2KB

                              MD5

                              968cb9309758126772781b83adb8a28f

                              SHA1

                              8da30e71accf186b2ba11da1797cf67f8f78b47c

                              SHA256

                              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                              SHA512

                              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              38f59a47b777f2fc52088e96ffb2baaf

                              SHA1

                              267224482588b41a96d813f6d9e9d924867062db

                              SHA256

                              13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

                              SHA512

                              4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              ab8ce148cb7d44f709fb1c460d03e1b0

                              SHA1

                              44d15744015155f3e74580c93317e12d2cc0f859

                              SHA256

                              014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

                              SHA512

                              f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                              Filesize

                              209KB

                              MD5

                              3e552d017d45f8fd93b94cfc86f842f2

                              SHA1

                              dbeebe83854328e2575ff67259e3fb6704b17a47

                              SHA256

                              27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

                              SHA512

                              e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              120B

                              MD5

                              6a71d960ff754273a209e679eeeca9fc

                              SHA1

                              8ff37eee0310112c66fff3198071b08da4b9da18

                              SHA256

                              e52fefef8761ef96903e5e602d0a3f38451d868d46c21a0b22db79183650e292

                              SHA512

                              1a66e1392b6b204c905a7f888604d37c074d80b5da1bbaabc27790c9eece745af361e02545d645c49d93626debbce6452528e0a305e3b6249e1253373bd8af43

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              814B

                              MD5

                              de2ee345135642de412cdb7a2d34c412

                              SHA1

                              05d71d3c3a4809c3ee3a9c4c1e904c79b2f93ec7

                              SHA256

                              d5c410c581a036bc449ee2a84cf0ad6354ae6a761107db2c73f205ce39fda4bf

                              SHA512

                              fc9b0c24ce4c8a4242f5ec5d1e493366415fc6c6afbf13e48a62153c396d93483217c40182e6cf6b625ef4dc88c00c42b35f53ea310d0a8718903cf0d842f5ca

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              fcab77e041f001e6569d0b6693d6b5b4

                              SHA1

                              ce5ad22fd4053233dccf68ec157c96ad2a32b134

                              SHA256

                              b08c87feb4f977cf871adb628fd8c1620a5f3153dcb037e64e026279e117c4e6

                              SHA512

                              01b64212a34d3ac92982b1187d2b32e572033b5f2def5355cfd17e3f5688c3abb0285e6cd83ee4cab3db10c4f78fb7387f1cf0e11ee8386d631d85399615d4be

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              31daed35a0679e33df39d68b1eec04dd

                              SHA1

                              83ee49800920a7e1cc0f4aba4e6b311c527cee5a

                              SHA256

                              095638bee29b7373d0e0f57811f06b4786b56bdc5cfff15309fc95a039044dfa

                              SHA512

                              bd74fa024e429ae44bd565bb753e3282d9f88e6323d396dcd49aa811b238fd3ade9af323174990a74403e737b0deac706971513ad004c7b05c74054a4633ec18

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              03f2d9b85d8517dd6dec3b3f3b50211e

                              SHA1

                              dc8913680e758209e8f9e89112a38cbefac7d100

                              SHA256

                              8053d557b0e8799c3333ae929f88c4269abed816a71412f076a1dba5889668c9

                              SHA512

                              a366f8685aec5f630242003effac8ecff12e1072d080dc691dd7f9ae72fc1320b9725594b812d078f16112ef6d40b9b73016310d8ff5fba26f727168798b4d5d

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                              Filesize

                              18KB

                              MD5

                              791c860c398d37b0eb142fe56c95503e

                              SHA1

                              980a23eae78623b25526eeb26ed80098bcd8f648

                              SHA256

                              b319be1cef49068a6ebdbfca8ee69df412d435e3cfe252f422ae2a6705716896

                              SHA512

                              827a34a761235c68fffd97837f076b62c8d380e388e4cefa007ea2c23d9ac029dc34fcfc8e158c8f0715d316a33ff60065d83347eab76d3f9df5d3ced782bb35

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nkur5snq.lgm.ps1

                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            • memory/1160-1086-0x00000000079A0000-0x00000000079A8000-memory.dmp

                              Filesize

                              32KB

                            • memory/1160-1077-0x0000000007CC0000-0x000000000833A000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/1160-1060-0x0000000006350000-0x000000000636E000-memory.dmp

                              Filesize

                              120KB

                            • memory/1160-1059-0x0000000005D80000-0x00000000060D4000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/1160-1049-0x0000000005D10000-0x0000000005D76000-memory.dmp

                              Filesize

                              408KB

                            • memory/1160-1048-0x0000000005C30000-0x0000000005C96000-memory.dmp

                              Filesize

                              408KB

                            • memory/1160-1047-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1160-1046-0x0000000005480000-0x00000000054A2000-memory.dmp

                              Filesize

                              136KB

                            • memory/1160-1044-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1160-1089-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1160-1061-0x0000000006390000-0x00000000063DC000-memory.dmp

                              Filesize

                              304KB

                            • memory/1160-1085-0x00000000079C0000-0x00000000079DA000-memory.dmp

                              Filesize

                              104KB

                            • memory/1160-1084-0x00000000078C0000-0x00000000078D4000-memory.dmp

                              Filesize

                              80KB

                            • memory/1160-1083-0x00000000078B0000-0x00000000078BE000-memory.dmp

                              Filesize

                              56KB

                            • memory/1160-1082-0x0000000007880000-0x0000000007891000-memory.dmp

                              Filesize

                              68KB

                            • memory/1160-1081-0x0000000007900000-0x0000000007996000-memory.dmp

                              Filesize

                              600KB

                            • memory/1160-1080-0x00000000076F0000-0x00000000076FA000-memory.dmp

                              Filesize

                              40KB

                            • memory/1160-1045-0x0000000005600000-0x0000000005C28000-memory.dmp

                              Filesize

                              6.2MB

                            • memory/1160-1078-0x0000000007680000-0x000000000769A000-memory.dmp

                              Filesize

                              104KB

                            • memory/1160-1079-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1160-1076-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1160-1075-0x0000000007380000-0x0000000007423000-memory.dmp

                              Filesize

                              652KB

                            • memory/1160-1074-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1160-1073-0x0000000006920000-0x000000000693E000-memory.dmp

                              Filesize

                              120KB

                            • memory/1160-1063-0x0000000070260000-0x00000000702AC000-memory.dmp

                              Filesize

                              304KB

                            • memory/1160-1062-0x0000000006960000-0x0000000006992000-memory.dmp

                              Filesize

                              200KB

                            • memory/1160-1043-0x0000000001430000-0x0000000001466000-memory.dmp

                              Filesize

                              216KB

                            • memory/3652-1252-0x0000000000400000-0x0000000000482000-memory.dmp

                              Filesize

                              520KB

                            • memory/3652-1110-0x0000000000400000-0x0000000000482000-memory.dmp

                              Filesize

                              520KB

                            • memory/3956-1118-0x00000000063A0000-0x00000000063EC000-memory.dmp

                              Filesize

                              304KB

                            • memory/3956-1121-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3956-1092-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3956-1094-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3956-1095-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3956-1111-0x0000000005A00000-0x0000000005D54000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/3956-1119-0x0000000006350000-0x0000000006372000-memory.dmp

                              Filesize

                              136KB

                            • memory/4388-22-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-1042-0x00000000053D0000-0x000000000541C000-memory.dmp

                              Filesize

                              304KB

                            • memory/4388-1041-0x00000000052E0000-0x0000000005378000-memory.dmp

                              Filesize

                              608KB

                            • memory/4388-1040-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/4388-1039-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/4388-3-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-20-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-4-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-32-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-40-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-6-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-54-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-8-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-10-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-12-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-16-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-18-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

                              Filesize

                              4KB

                            • memory/4388-1091-0x0000000006590000-0x0000000006B34000-memory.dmp

                              Filesize

                              5.6MB

                            • memory/4388-1093-0x00000000054D0000-0x0000000005524000-memory.dmp

                              Filesize

                              336KB

                            • memory/4388-24-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-26-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-28-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-30-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-1100-0x0000000074CB0000-0x0000000075460000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/4388-34-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-36-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-38-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-42-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-44-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-46-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-48-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-50-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-52-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-56-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-58-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-60-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-62-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-64-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-66-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-14-0x0000000005000000-0x0000000005112000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-2-0x0000000005000000-0x0000000005118000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4388-1-0x0000000000560000-0x000000000067A000-memory.dmp

                              Filesize

                              1.1MB