Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 01:50

General

  • Target

    c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee.exe

  • Size

    1.8MB

  • MD5

    2bb882f05824de9a479e3b8351cdf58d

  • SHA1

    153c24fd281341558e3c307a3c13fcf78a30071b

  • SHA256

    c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee

  • SHA512

    3742e1d6919e2f4c68f34bcebb43d189e7f28323a5a8fd4d081f12957fc319842c2592d191f99f4f28997ad566c67d7d4b75e42e657ce4ab4bca6ad89bc9001c

  • SSDEEP

    49152:dMpkyAxbCDuZJfaJqYvdL3bRHhfJi2K1GFlE:+tAxbCqZCqYVL3b1RJv0GE

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 13 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:2724
      • C:\Users\Admin\AppData\Local\Temp\1001033001\amadycry.exe
        "C:\Users\Admin\AppData\Local\Temp\1001033001\amadycry.exe"
        2⤵
        • Executes dropped EXE
        PID:5872
    • C:\Users\Admin\AppData\Local\Temp\c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee.exe
      "C:\Users\Admin\AppData\Local\Temp\c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2068
    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4468
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            4⤵
              PID:3176
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\045580317372_Desktop.zip' -CompressionLevel Optimal
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:220
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
          2⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:4516
        • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
          "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4940
            • C:\Users\Admin\AppData\Local\Temp\1000022001\97d2443fb7.exe
              "C:\Users\Admin\AppData\Local\Temp\1000022001\97d2443fb7.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              PID:3220
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
              4⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:6132
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                5⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5156
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  6⤵
                    PID:5220
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\045580317372_Desktop.zip' -CompressionLevel Optimal
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5416
              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
                4⤵
                  PID:3580
                • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe"
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:2512
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                  4⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  PID:5156
            • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
              "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
              2⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              PID:3876
            • C:\Users\Admin\AppData\Local\Temp\1001033001\amadycry.exe
              "C:\Users\Admin\AppData\Local\Temp\1001033001\amadycry.exe"
              2⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4392
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:2040
          • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
            C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
            1⤵
            • Executes dropped EXE
            PID:5556
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:5544

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  3KB

                  MD5

                  8358e35f7233f23485f5bebfdd94ac45

                  SHA1

                  b055602516d07926b0bd13860887294482e2b24d

                  SHA256

                  e43a3c5a6279c3fe669b46fe4acd681c5f4c58afb06efe6a8aefffc9bc1ccf42

                  SHA512

                  984ff47aa9c00c4d13d53772f3c92c8b64e26fc2b8af5aca9df443eecf68dc238f29ad01d177c88458f8f2f5409522e59186d8205f4b8bec6926fcfec7f7f55d

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  cef374ab8fe4fe51d97d2615a88b076f

                  SHA1

                  eed2f61fe466be489411a713ba4c6944dc576ced

                  SHA256

                  1774d41c6d8f1ebb264433d11f66f3972243abed4f6f54e085cf5e6cbd498baa

                  SHA512

                  6b89f9a6688b530629312e084c1e5551c07139554440044c9df54b833b01cc9a020fba02c79dd0190a2cd65275fa37dfc86b077ce95821d22127503fff15b4f2

                • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

                  Filesize

                  1.8MB

                  MD5

                  2bb882f05824de9a479e3b8351cdf58d

                  SHA1

                  153c24fd281341558e3c307a3c13fcf78a30071b

                  SHA256

                  c328805ce084493a7d4d761e65dc1820a5626c2da1622be93a7f095c67a7cbee

                  SHA512

                  3742e1d6919e2f4c68f34bcebb43d189e7f28323a5a8fd4d081f12957fc319842c2592d191f99f4f28997ad566c67d7d4b75e42e657ce4ab4bca6ad89bc9001c

                • C:\Users\Admin\AppData\Local\Temp\1000022001\97d2443fb7.exe

                  Filesize

                  3.0MB

                  MD5

                  2763d20c2151f640cabffc4ae240c33f

                  SHA1

                  efa706682ada938daea3dd675fb303136b2e2310

                  SHA256

                  44e14f844afcc6aa16effc6c090efa62be7491bcfcec572b260199e31845da5b

                  SHA512

                  b29583c52db36be8dc45a745918f3a592978c15992ab1895806571ff28f1a574fd388207fd653f18a4b75fb4ccd597a27e7fc13d16fff59e43d771ad26395e81

                • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe

                  Filesize

                  413KB

                  MD5

                  d467222c3bd563cb72fa49302f80b079

                  SHA1

                  9335e2a36abb8309d8a2075faf78d66b968b2a91

                  SHA256

                  fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                  SHA512

                  484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe

                  Filesize

                  1.8MB

                  MD5

                  0f1f137ec50935756eb506a1e7a24796

                  SHA1

                  163426991cd993b8590e3739cbaa500ddb258806

                  SHA256

                  6e22f3016206414917351ea4221b4167318e48442b3d17a0b33546930ed0e4d2

                  SHA512

                  c88e472e4c6942665a11f15e4f2e3a2ff00492eeee443a8c392a48b3b1c175ae87d1b8e0c29b63a669d23b522a2cc17bbff74bdd6767a56cfe9b75ab3e74865d

                • C:\Users\Admin\AppData\Local\Temp\1001033001\amadycry.exe

                  Filesize

                  2.3MB

                  MD5

                  90c738cebe2f8dda5d53e777ad286a43

                  SHA1

                  58daf4a99c9c148f38b3e6173d5f7ac01bcfaf16

                  SHA256

                  d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e

                  SHA512

                  7b77c041a5e1548403db8f749c90209a5bb4a8c1c178003d7af2641f94e1745b6e89abadfed441dd41c492cd134863afb57353a918d94ce308b2884cfdf29620

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vb5cxnpd.xkn.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  109KB

                  MD5

                  2afdbe3b99a4736083066a13e4b5d11a

                  SHA1

                  4d4856cf02b3123ac16e63d4a448cdbcb1633546

                  SHA256

                  8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                  SHA512

                  d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  1.2MB

                  MD5

                  92fbdfccf6a63acef2743631d16652a7

                  SHA1

                  971968b1378dd89d59d7f84bf92f16fc68664506

                  SHA256

                  b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                  SHA512

                  b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  109KB

                  MD5

                  726cd06231883a159ec1ce28dd538699

                  SHA1

                  404897e6a133d255ad5a9c26ac6414d7134285a2

                  SHA256

                  12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                  SHA512

                  9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                  Filesize

                  1.2MB

                  MD5

                  15a42d3e4579da615a384c717ab2109b

                  SHA1

                  22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                  SHA256

                  3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                  SHA512

                  1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                • memory/220-66-0x00007FFEED210000-0x00007FFEEDCD1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/220-59-0x00000216A1720000-0x00000216A1732000-memory.dmp

                  Filesize

                  72KB

                • memory/220-58-0x00000216A0920000-0x00000216A0930000-memory.dmp

                  Filesize

                  64KB

                • memory/220-57-0x00000216A0920000-0x00000216A0930000-memory.dmp

                  Filesize

                  64KB

                • memory/220-56-0x00000216A0920000-0x00000216A0930000-memory.dmp

                  Filesize

                  64KB

                • memory/220-55-0x00000216A0920000-0x00000216A0930000-memory.dmp

                  Filesize

                  64KB

                • memory/220-54-0x00007FFEED210000-0x00007FFEEDCD1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/220-53-0x00000216A08B0000-0x00000216A08D2000-memory.dmp

                  Filesize

                  136KB

                • memory/220-60-0x00000216A0900000-0x00000216A090A000-memory.dmp

                  Filesize

                  40KB

                • memory/1244-21-0x00000000052D0000-0x00000000052D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-165-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-29-0x0000000005320000-0x0000000005321000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-28-0x0000000005330000-0x0000000005331000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-30-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-25-0x00000000052C0000-0x00000000052C1000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-43-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-24-0x00000000052A0000-0x00000000052A1000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-26-0x00000000052B0000-0x00000000052B1000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-22-0x00000000052E0000-0x00000000052E1000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-23-0x0000000005310000-0x0000000005311000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-216-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-20-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-19-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-128-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-27-0x0000000005300000-0x0000000005301000-memory.dmp

                  Filesize

                  4KB

                • memory/1244-95-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1244-67-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2068-1-0x0000000077B14000-0x0000000077B16000-memory.dmp

                  Filesize

                  8KB

                • memory/2068-8-0x0000000004F00000-0x0000000004F01000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-10-0x0000000004F80000-0x0000000004F81000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-11-0x0000000004F70000-0x0000000004F71000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-7-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-16-0x0000000000C50000-0x00000000010FB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2068-9-0x0000000004F50000-0x0000000004F51000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-2-0x0000000000C50000-0x00000000010FB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2068-0-0x0000000000C50000-0x00000000010FB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2068-4-0x0000000004F30000-0x0000000004F31000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-3-0x0000000004F20000-0x0000000004F21000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-5-0x0000000004F10000-0x0000000004F11000-memory.dmp

                  Filesize

                  4KB

                • memory/2068-6-0x0000000004F60000-0x0000000004F61000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-96-0x0000000000C10000-0x00000000010C4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2748-116-0x0000000000C10000-0x00000000010C4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2748-106-0x0000000005310000-0x0000000005311000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-104-0x0000000005320000-0x0000000005321000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-103-0x00000000052A0000-0x00000000052A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-101-0x00000000052F0000-0x00000000052F1000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-98-0x00000000052C0000-0x00000000052C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-97-0x0000000000C10000-0x00000000010C4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2748-99-0x00000000052D0000-0x00000000052D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-102-0x0000000005290000-0x0000000005291000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-100-0x00000000052B0000-0x00000000052B1000-memory.dmp

                  Filesize

                  4KB

                • memory/3220-188-0x0000000000C20000-0x0000000000FD0000-memory.dmp

                  Filesize

                  3.7MB

                • memory/3220-186-0x0000000000C20000-0x0000000000FD0000-memory.dmp

                  Filesize

                  3.7MB

                • memory/3876-162-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-131-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-136-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-137-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-138-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-139-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-140-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-141-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-142-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-143-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-144-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-145-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-146-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-147-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-148-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-149-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-150-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-151-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-153-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-152-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-154-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-155-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-156-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-157-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-158-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-159-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-160-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-161-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-134-0x0000000000950000-0x0000000000DFB000-memory.dmp

                  Filesize

                  4.7MB

                • memory/3876-163-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-164-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/3876-135-0x0000000000400000-0x000000000090F000-memory.dmp

                  Filesize

                  5.1MB

                • memory/4392-235-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-223-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-211-0x00000000013C0000-0x00000000013D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4392-212-0x0000000005A00000-0x0000000005C4E000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-213-0x0000000006230000-0x00000000067D4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4392-246-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-244-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-218-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-208-0x0000000000840000-0x0000000000A94000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-221-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-229-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-227-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-225-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-217-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-209-0x0000000073130000-0x00000000738E0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4392-232-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4392-240-0x0000000005A00000-0x0000000005C48000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4940-119-0x00000000004C0000-0x0000000000974000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4940-210-0x00000000004C0000-0x0000000000974000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4940-124-0x0000000004E80000-0x0000000004E81000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-125-0x0000000004E70000-0x0000000004E71000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-187-0x00000000004C0000-0x0000000000974000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4940-166-0x00000000004C0000-0x0000000000974000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4940-126-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-123-0x0000000004E60000-0x0000000004E61000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-120-0x0000000004E90000-0x0000000004E91000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-122-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-121-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-127-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

                  Filesize

                  4KB

                • memory/4940-118-0x00000000004C0000-0x0000000000974000-memory.dmp

                  Filesize

                  4.7MB