Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-11-2022 23:52

General

  • Target

    549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690.exe

  • Size

    246KB

  • MD5

    0ffc57a0b455d613e887e58cced3797e

  • SHA1

    10e652967ea3e4140be52f4f7a77f4308e87fe93

  • SHA256

    549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690

  • SHA512

    9b84aefd4e5bfedeebd734995a829fcc2c89d7cdbd63af66035bdcc8e4a4a20786535f7a77a5aa644682a05548a2075466fb7e1500294d598ef4deeb28b4c6bf

  • SSDEEP

    6144:frdmLwvhK59diSwBkSdI1PZTCcpw85P7Nq6:frdmkvha9I61PJpV5U

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Extracted

Family

redline

Botnet

5139967220

C2

79.137.192.6:8362

Extracted

Family

laplas

C2

79.137.206.137

Attributes
  • api_key

    0f183cb4288647960d1c458ed8456bf6524ebfbc16ebc53caab66c2376fd0eef

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Laplas Clipper

    Laplas is a crypto wallet stealer with two variants written in Golang and C#.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690.exe
    "C:\Users\Admin\AppData\Local\Temp\549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:5096
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:1688
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "rovwer.exe" /P "Admin:N"
            4⤵
              PID:4836
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "rovwer.exe" /P "Admin:R" /E
              4⤵
                PID:3724
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:3548
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\99e342142d" /P "Admin:N"
                  4⤵
                    PID:4384
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\99e342142d" /P "Admin:R" /E
                    4⤵
                      PID:4596
                  • C:\Users\Admin\AppData\Local\Temp\1000212001\3000.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000212001\3000.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:4560
                  • C:\Users\Admin\AppData\Local\Temp\1000215001\zzz.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000215001\zzz.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1964
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\1000215001\zzz.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:804
                      • C:\Windows\system32\choice.exe
                        choice /C Y /N /D Y /T 0
                        5⤵
                          PID:1152
                    • C:\Users\Admin\AppData\Local\Temp\1000216001\1.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000216001\1.exe"
                      3⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Sets service image path in registry
                      • Checks whether UAC is enabled
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:1284
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000216001\1.exe" -Force
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1052
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                        4⤵
                          PID:3804
                      • C:\Users\Admin\AppData\Local\Temp\1000217001\1000.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000217001\1000.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:416
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3124
                          • C:\Users\Admin\AppData\Local\Temp\Smart.exe
                            "C:\Users\Admin\AppData\Local\Temp\Smart.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2172
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /C schtasks /create /tn RYplbyBDUW /tr C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
                              6⤵
                                PID:2268
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn RYplbyBDUW /tr C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
                                  7⤵
                                  • Creates scheduled task(s)
                                  PID:5068
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 336
                            4⤵
                            • Program crash
                            PID:3740
                    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
                      C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4840
                    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
                      C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4716
                    • C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
                      C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4568

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\1000212001\3000.exe

                      Filesize

                      2.4MB

                      MD5

                      77181eb9385b899f4bce3387a2efe18c

                      SHA1

                      68488c2d2aae96c6f552bcddb81e198b0390312a

                      SHA256

                      e18597f8343d2752ecfea69c4615ea58f37d948ee5d0741791410fb2a4827b1b

                      SHA512

                      3d034f0b238ad5da850d38f3f247693415ca1773aab84f25c32d500864d7a11b8385d2c5da45a19950c5cdad9664963af85ae13d48da7fceee895d847f94eeb9

                    • C:\Users\Admin\AppData\Local\Temp\1000215001\zzz.exe

                      Filesize

                      2.4MB

                      MD5

                      e289e55c96e8c077a682aa0530841161

                      SHA1

                      d5154044ff465fa535955c857118b59124c85547

                      SHA256

                      a9e18560e367a43b940ba8ff800dc6eb77c44d03ebc9e1686d0f2e8e5496814a

                      SHA512

                      a9a33b18c30a0016b7d2d5818c9922afa31e79e6783021dfa838672c7900b22a8b9041df6b0847a54e39b40fb7e62b2c341de64b140b24d54c0cb41a49301eaf

                    • C:\Users\Admin\AppData\Local\Temp\1000215001\zzz.exe

                      Filesize

                      2.4MB

                      MD5

                      e289e55c96e8c077a682aa0530841161

                      SHA1

                      d5154044ff465fa535955c857118b59124c85547

                      SHA256

                      a9e18560e367a43b940ba8ff800dc6eb77c44d03ebc9e1686d0f2e8e5496814a

                      SHA512

                      a9a33b18c30a0016b7d2d5818c9922afa31e79e6783021dfa838672c7900b22a8b9041df6b0847a54e39b40fb7e62b2c341de64b140b24d54c0cb41a49301eaf

                    • C:\Users\Admin\AppData\Local\Temp\1000216001\1.exe

                      Filesize

                      485KB

                      MD5

                      197cc0b311afc440dd150387e68bf49f

                      SHA1

                      78434666b854de78dfbfb253e66644865d324586

                      SHA256

                      d0f5a3be9ab80e06600ffcb13d897f325b7c8737b895223b3b7e03ecc79abbca

                      SHA512

                      93e805b0956a69a2f9bcabd059bafef689a82aa8654a71bf56d9834db9a5d1904aca34178e02b47f85b6bbac3b4430209dc989071e50c1d63c152daeb5052fed

                    • C:\Users\Admin\AppData\Local\Temp\1000216001\1.exe

                      Filesize

                      485KB

                      MD5

                      197cc0b311afc440dd150387e68bf49f

                      SHA1

                      78434666b854de78dfbfb253e66644865d324586

                      SHA256

                      d0f5a3be9ab80e06600ffcb13d897f325b7c8737b895223b3b7e03ecc79abbca

                      SHA512

                      93e805b0956a69a2f9bcabd059bafef689a82aa8654a71bf56d9834db9a5d1904aca34178e02b47f85b6bbac3b4430209dc989071e50c1d63c152daeb5052fed

                    • C:\Users\Admin\AppData\Local\Temp\1000217001\1000.exe

                      Filesize

                      182KB

                      MD5

                      75e4e9080625c45150fb0c729677203e

                      SHA1

                      c31559bf53e9be7501c6fcad32ad29368d514e7d

                      SHA256

                      081efe08a54211147b7fb7f7dafba081da5ca5c0902f741003c4e4374e773869

                      SHA512

                      fcb0e13c5e3e1bf54dcb22470fc83097dffffd191e6f112595e0338b0a9f33dd45feb774a94dc8a00f35c09970d671a057ff5bd646541872abe8f26aa791bcbe

                    • C:\Users\Admin\AppData\Local\Temp\1000217001\1000.exe

                      Filesize

                      182KB

                      MD5

                      75e4e9080625c45150fb0c729677203e

                      SHA1

                      c31559bf53e9be7501c6fcad32ad29368d514e7d

                      SHA256

                      081efe08a54211147b7fb7f7dafba081da5ca5c0902f741003c4e4374e773869

                      SHA512

                      fcb0e13c5e3e1bf54dcb22470fc83097dffffd191e6f112595e0338b0a9f33dd45feb774a94dc8a00f35c09970d671a057ff5bd646541872abe8f26aa791bcbe

                    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe

                      Filesize

                      246KB

                      MD5

                      0ffc57a0b455d613e887e58cced3797e

                      SHA1

                      10e652967ea3e4140be52f4f7a77f4308e87fe93

                      SHA256

                      549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690

                      SHA512

                      9b84aefd4e5bfedeebd734995a829fcc2c89d7cdbd63af66035bdcc8e4a4a20786535f7a77a5aa644682a05548a2075466fb7e1500294d598ef4deeb28b4c6bf

                    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe

                      Filesize

                      246KB

                      MD5

                      0ffc57a0b455d613e887e58cced3797e

                      SHA1

                      10e652967ea3e4140be52f4f7a77f4308e87fe93

                      SHA256

                      549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690

                      SHA512

                      9b84aefd4e5bfedeebd734995a829fcc2c89d7cdbd63af66035bdcc8e4a4a20786535f7a77a5aa644682a05548a2075466fb7e1500294d598ef4deeb28b4c6bf

                    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe

                      Filesize

                      246KB

                      MD5

                      0ffc57a0b455d613e887e58cced3797e

                      SHA1

                      10e652967ea3e4140be52f4f7a77f4308e87fe93

                      SHA256

                      549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690

                      SHA512

                      9b84aefd4e5bfedeebd734995a829fcc2c89d7cdbd63af66035bdcc8e4a4a20786535f7a77a5aa644682a05548a2075466fb7e1500294d598ef4deeb28b4c6bf

                    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe

                      Filesize

                      246KB

                      MD5

                      0ffc57a0b455d613e887e58cced3797e

                      SHA1

                      10e652967ea3e4140be52f4f7a77f4308e87fe93

                      SHA256

                      549c9e7ffa89e87dcce9be1c0c0f6c5e119de15daf142d53327d15ba91607690

                      SHA512

                      9b84aefd4e5bfedeebd734995a829fcc2c89d7cdbd63af66035bdcc8e4a4a20786535f7a77a5aa644682a05548a2075466fb7e1500294d598ef4deeb28b4c6bf

                    • C:\Users\Admin\AppData\Local\Temp\Smart.exe

                      Filesize

                      4.6MB

                      MD5

                      21f79006cf7560986de8ec8a60998894

                      SHA1

                      b4e170268721f7ddfb33c2cb5af3f953a0f16278

                      SHA256

                      3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25

                      SHA512

                      f794f98972f9a7ee2cf5ee9541db8f83d6670cea95289dd8f55a52d576b2fdce58136d21b85f278ca28e545c522efecaea6529736ca89e62f8f596bd102f5615

                    • C:\Users\Admin\AppData\Local\Temp\Smart.exe

                      Filesize

                      4.6MB

                      MD5

                      21f79006cf7560986de8ec8a60998894

                      SHA1

                      b4e170268721f7ddfb33c2cb5af3f953a0f16278

                      SHA256

                      3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25

                      SHA512

                      f794f98972f9a7ee2cf5ee9541db8f83d6670cea95289dd8f55a52d576b2fdce58136d21b85f278ca28e545c522efecaea6529736ca89e62f8f596bd102f5615

                    • C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe

                      Filesize

                      142.4MB

                      MD5

                      493382ba22cf65963b923742f4d6e21e

                      SHA1

                      9a82698c3ceaa3aa4784894ae4cf0bf926675103

                      SHA256

                      6a7f3534acf80ad76df4b2fccf0eb14a9b7017d9858d723601c71b412fb7a687

                      SHA512

                      07a5bfa08a571b7872731e5e7b8109e2a99178034c80b20091e560947cb577913c2b3bd3a2f44c8c9848e213e992fda98a83bbacb2b3c060a9223bc193a80a33

                    • C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe

                      Filesize

                      142.8MB

                      MD5

                      c509a98c2045ba79acbe30e9210bc9e0

                      SHA1

                      557d7d013ff47d98034fa76d8404bd976fb07c7d

                      SHA256

                      ca7d894d2bc4b65d32bb754de5986165ab54a68e6faf244f4c49d58576118dc8

                      SHA512

                      dd3ec646bcdb315960932c98b6638c090073521abff584eeffcfa556a1d78f1f688b17fe30c8bdc56e872a3dc503be33093e368bb297b6124591134e8de403b2

                    • memory/416-398-0x0000000000000000-mapping.dmp

                    • memory/572-138-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-164-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-137-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-139-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-140-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-141-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-143-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-144-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-145-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-146-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-147-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-148-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-149-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-150-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-151-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-152-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-154-0x0000000002380000-0x00000000023BE000-memory.dmp

                      Filesize

                      248KB

                    • memory/572-153-0x0000000000790000-0x00000000008DA000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/572-155-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-156-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-157-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-158-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-159-0x0000000000400000-0x000000000065B000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/572-160-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-161-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-162-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-163-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-136-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-165-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-166-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-167-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-168-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-169-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-170-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-135-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-134-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-133-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-176-0x0000000002380000-0x00000000023BE000-memory.dmp

                      Filesize

                      248KB

                    • memory/572-178-0x0000000000400000-0x000000000065B000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/572-132-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-131-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-130-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-129-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-128-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-127-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-126-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-125-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-120-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-124-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-123-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-121-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/572-122-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/804-352-0x0000000000000000-mapping.dmp

                    • memory/1052-367-0x0000019ECC150000-0x0000019ECC172000-memory.dmp

                      Filesize

                      136KB

                    • memory/1052-370-0x0000019ECC480000-0x0000019ECC4F6000-memory.dmp

                      Filesize

                      472KB

                    • memory/1052-362-0x0000000000000000-mapping.dmp

                    • memory/1152-353-0x0000000000000000-mapping.dmp

                    • memory/1284-361-0x00000232F5490000-0x00000232F550A000-memory.dmp

                      Filesize

                      488KB

                    • memory/1284-360-0x00000232DB100000-0x00000232DB17E000-memory.dmp

                      Filesize

                      504KB

                    • memory/1284-357-0x0000000000000000-mapping.dmp

                    • memory/1688-243-0x0000000000000000-mapping.dmp

                    • memory/1964-349-0x0000000000000000-mapping.dmp

                    • memory/1964-354-0x0000000000220000-0x0000000000A02000-memory.dmp

                      Filesize

                      7.9MB

                    • memory/2172-846-0x0000000000000000-mapping.dmp

                    • memory/2268-895-0x0000000000000000-mapping.dmp

                    • memory/3124-588-0x000000000A470000-0x000000000A4E6000-memory.dmp

                      Filesize

                      472KB

                    • memory/3124-519-0x00000000066D0000-0x00000000066E2000-memory.dmp

                      Filesize

                      72KB

                    • memory/3124-571-0x0000000009F40000-0x000000000A102000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/3124-575-0x0000000009ED0000-0x0000000009F36000-memory.dmp

                      Filesize

                      408KB

                    • memory/3124-536-0x0000000008F40000-0x000000000904A000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/3124-534-0x0000000008D50000-0x0000000008D9B000-memory.dmp

                      Filesize

                      300KB

                    • memory/3124-524-0x0000000006790000-0x00000000067CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3124-587-0x000000000A3D0000-0x000000000A462000-memory.dmp

                      Filesize

                      584KB

                    • memory/3124-593-0x000000000A5C0000-0x000000000A5DE000-memory.dmp

                      Filesize

                      120KB

                    • memory/3124-572-0x000000000A640000-0x000000000AB6C000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/3124-517-0x0000000009360000-0x0000000009966000-memory.dmp

                      Filesize

                      6.0MB

                    • memory/3124-589-0x000000000B070000-0x000000000B56E000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/3124-512-0x0000000000530000-0x000000000054E000-memory.dmp

                      Filesize

                      120KB

                    • memory/3124-476-0x000000000054972E-mapping.dmp

                    • memory/3548-294-0x0000000000000000-mapping.dmp

                    • memory/3556-228-0x0000000000000000-mapping.dmp

                    • memory/3724-273-0x0000000000000000-mapping.dmp

                    • memory/3804-427-0x0000000000403BA0-mapping.dmp

                    • memory/3804-475-0x00000000013C0000-0x00000000013C9000-memory.dmp

                      Filesize

                      36KB

                    • memory/3804-473-0x0000000000400000-0x0000000000438000-memory.dmp

                      Filesize

                      224KB

                    • memory/4316-189-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-179-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-183-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-174-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-184-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-185-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-186-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-356-0x0000000000400000-0x000000000065B000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/4316-355-0x00000000006B0000-0x000000000075E000-memory.dmp

                      Filesize

                      696KB

                    • memory/4316-187-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-188-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-191-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-171-0x0000000000000000-mapping.dmp

                    • memory/4316-190-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-173-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-177-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-192-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-181-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-217-0x0000000000400000-0x000000000065B000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/4316-175-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4316-215-0x00000000006B0000-0x000000000075E000-memory.dmp

                      Filesize

                      696KB

                    • memory/4316-180-0x0000000077D60000-0x0000000077EEE000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4384-296-0x0000000000000000-mapping.dmp

                    • memory/4560-328-0x0000000000000000-mapping.dmp

                    • memory/4596-314-0x0000000000000000-mapping.dmp

                    • memory/4716-1011-0x00000000007CE000-0x00000000007ED000-memory.dmp

                      Filesize

                      124KB

                    • memory/4716-1012-0x0000000000400000-0x000000000065B000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/4836-253-0x0000000000000000-mapping.dmp

                    • memory/4840-937-0x000000000088E000-0x00000000008AD000-memory.dmp

                      Filesize

                      124KB

                    • memory/4840-938-0x0000000000400000-0x000000000065B000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/5068-905-0x0000000000000000-mapping.dmp

                    • memory/5096-226-0x0000000000000000-mapping.dmp