Analysis

  • max time kernel
    38s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 22:58

General

  • Target

    85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40.exe

  • Size

    1.8MB

  • MD5

    7f40d98b2ba64348358fd75b5f0bdcfb

  • SHA1

    e9f33ceeac6b2de2f63f9e73902b2926ba61364c

  • SHA256

    85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40

  • SHA512

    c275ae0f9199f7fc024565e55afdbd952ad46ebcb890018acd22893e6e063a1db0e995fae77fc6e3a2ccb0971666e7ca5b920f4e8fc75b39f830bc0f45799abd

  • SSDEEP

    24576:zbBE9EkzS56PSpOhed47Vm49wmFNaC0GL3bJN7xWiJ3HA7blfGPOo/2GVgUNPJ9D:zbBMETUqpO8deNNPT0HGZ+UNga

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Detects executables packed with Themida 10 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 18 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40.exe
    "C:\Users\Admin\AppData\Local\Temp\85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\AppData\Local\Temp\1000042001\adc0011383.exe
        "C:\Users\Admin\AppData\Local\Temp\1000042001\adc0011383.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        PID:2892
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
          PID:2212
        • C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          PID:2436
        • C:\Users\Admin\AppData\Local\Temp\1000051001\f770f38967.exe
          "C:\Users\Admin\AppData\Local\Temp\1000051001\f770f38967.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2832
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
            4⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1132
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6689758,0x7fef6689768,0x7fef6689778
              5⤵
                PID:1080
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:2
                5⤵
                  PID:1336
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:8
                  5⤵
                    PID:1396
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:8
                    5⤵
                      PID:468
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:1
                      5⤵
                        PID:2148
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2300 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:1
                        5⤵
                          PID:2836
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3212 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:1
                          5⤵
                            PID:2416
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1548 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:2
                            5⤵
                              PID:1180
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2792 --field-trial-handle=1312,i,6868605695981445345,2628037694563505978,131072 /prefetch:8
                              5⤵
                                PID:1764
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                            3⤵
                            • Loads dropped DLL
                            PID:1248
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                              4⤵
                              • Blocklisted process makes network request
                              • Loads dropped DLL
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2236
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profiles
                                5⤵
                                  PID:1548
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\452737119395_Desktop.zip' -CompressionLevel Optimal
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2228
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                              3⤵
                              • Blocklisted process makes network request
                              • Loads dropped DLL
                              PID:1648
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:2728

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                            Filesize

                            264KB

                            MD5

                            f50f89a0a91564d0b8a211f8921aa7de

                            SHA1

                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                            SHA256

                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                            SHA512

                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                            Filesize

                            16B

                            MD5

                            aefd77f47fb84fae5ea194496b44c67a

                            SHA1

                            dcfbb6a5b8d05662c4858664f81693bb7f803b82

                            SHA256

                            4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                            SHA512

                            b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            ef61562c2d2fc1bb55c319611e9f6f01

                            SHA1

                            29beb784232fabd146b76ed2bb592aa64364d5f6

                            SHA256

                            7be3218d5edd9169dccaabbb1f988094dbd9bd7159ffbda9132561bb6d89ce78

                            SHA512

                            3654bc7e8d52e92dae200eb1006ede2c9dc65db8b17323993543620fe609426cc75f3d063d94ff8646156d5fce6ddb94b338d03c05998ef886a58ea4948b2f01

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            c4961780eb61c7839d1ca21859d725c1

                            SHA1

                            3b418052ae19f62cb6d432da4f7fc67737c7504c

                            SHA256

                            304cb937eafa81f255a24dc7dfc4af7f9e4eee65151c1df795e30e6e14be8e74

                            SHA512

                            4cec58bec51ed32cfc1b4aa4e6bae6a37f960a84f0372bafad5f04bdf9be9751da953d3ad39d774f2c22e6acc51f4cd562325750557ec2b7e6b5c00acdfbf686

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            89568b34294355d476f540f23bc0c621

                            SHA1

                            a735296c8f31e3e8f6680be897d0fcff3254aa1f

                            SHA256

                            8a6f9a1060403dfd0984c6405bf024cd0baa90387e27f0b426f5fcf6228f3ecb

                            SHA512

                            7ad9052eda3dbbd02f1ca4adc8416d3e8f1b4435d854a9f1b3b77ce892ffb3727958021d24dabc7cdf920cc340ef8e22df663c6010a1c3fcebc8fa426b6952cc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                            Filesize

                            16B

                            MD5

                            18e723571b00fb1694a3bad6c78e4054

                            SHA1

                            afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                            SHA256

                            8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                            SHA512

                            43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

                            Filesize

                            1.8MB

                            MD5

                            7f40d98b2ba64348358fd75b5f0bdcfb

                            SHA1

                            e9f33ceeac6b2de2f63f9e73902b2926ba61364c

                            SHA256

                            85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40

                            SHA512

                            c275ae0f9199f7fc024565e55afdbd952ad46ebcb890018acd22893e6e063a1db0e995fae77fc6e3a2ccb0971666e7ca5b920f4e8fc75b39f830bc0f45799abd

                          • C:\Users\Admin\AppData\Local\Temp\1000042001\adc0011383.exe

                            Filesize

                            3.0MB

                            MD5

                            3edac80b993a482f7112524ab56c8ab0

                            SHA1

                            e9aca74db0ddbbc6eccf8039a7c7a892fe3f746c

                            SHA256

                            5af1635dd01cd83fc6c9bb03f52f066ff9fd2c8e6e5a9260f71288fba4fe438d

                            SHA512

                            e7afb65176dcc69c8af46da866a4ba762ee1fe039a94089a1ed6f61d6ee4845c1fdd32f9cfbf343399db3cffc8bbb5a5ef81d0f78face4d1262e5e736c64b45b

                          • C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe

                            Filesize

                            1.8MB

                            MD5

                            5c1591069b7d16c4e1c354e8589e3e29

                            SHA1

                            0822e58e1d4674a3ae29351a4eea38012616efd4

                            SHA256

                            fe04a0fbd786f1f69cb8716383383149a910de26bfed62ea9611f2ff357cb869

                            SHA512

                            82bd3a6343ab833702b327652f45cbd92b53f41e9e4caa25b1b589041f6c9963057e378ff5cf48880e6f63c3c588379d693da57dff858abe822ce8bf034e1253

                          • C:\Users\Admin\AppData\Local\Temp\1000051001\f770f38967.exe

                            Filesize

                            1.1MB

                            MD5

                            c1a04495bca429962b8b3344fa8684a2

                            SHA1

                            b6f77a13ad98d5cdd56152fe0ff1fca62aeb286c

                            SHA256

                            4896377dfe62c7180cc960702291f7467ec7a2209b207cbfd63ccf27f29af524

                            SHA512

                            1cbb5fa5a027898dff3bf12c7c2428f56243b21b5f99101f235ae0dc2283a8421f68667f95e7ab1b6c8ec32d62f2f5d41a2f736dcbf5b0bce087ae317406afd4

                          • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                            Filesize

                            109KB

                            MD5

                            726cd06231883a159ec1ce28dd538699

                            SHA1

                            404897e6a133d255ad5a9c26ac6414d7134285a2

                            SHA256

                            12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                            SHA512

                            9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                          • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                            Filesize

                            1.2MB

                            MD5

                            15a42d3e4579da615a384c717ab2109b

                            SHA1

                            22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                            SHA256

                            3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                            SHA512

                            1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                          • \??\pipe\crashpad_1132_PUBKMITYVUHASYXQ

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                          • memory/2228-224-0x000000001B850000-0x000000001BB32000-memory.dmp

                            Filesize

                            2.9MB

                          • memory/2320-3-0x00000000009A0000-0x00000000009A2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2320-5-0x0000000000980000-0x0000000000981000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-17-0x00000000004B0000-0x00000000004B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-18-0x0000000000E70000-0x0000000000E71000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-14-0x0000000000920000-0x0000000000921000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-1-0x0000000077070000-0x0000000077072000-memory.dmp

                            Filesize

                            8KB

                          • memory/2320-28-0x00000000013E0000-0x000000000189F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2320-26-0x0000000007280000-0x000000000773F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2320-4-0x0000000000A40000-0x0000000000A41000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-12-0x0000000000580000-0x0000000000581000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-6-0x0000000000D40000-0x0000000000D41000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-0-0x00000000013E0000-0x000000000189F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2320-7-0x00000000004A0000-0x00000000004A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-8-0x0000000000590000-0x0000000000591000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-9-0x0000000000930000-0x0000000000931000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-10-0x0000000000990000-0x0000000000991000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-11-0x0000000000C30000-0x0000000000C31000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-13-0x0000000000910000-0x0000000000911000-memory.dmp

                            Filesize

                            4KB

                          • memory/2320-2-0x00000000013E0000-0x000000000189F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2320-15-0x0000000000D90000-0x0000000000D91000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-118-0x0000000002680000-0x0000000002681000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-125-0x00000000001E0000-0x00000000006A9000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2436-120-0x0000000000950000-0x0000000000951000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-124-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-117-0x00000000022C0000-0x00000000022C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-94-0x00000000023D0000-0x00000000023D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-95-0x00000000024F0000-0x00000000024F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-96-0x00000000023B0000-0x00000000023B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-97-0x0000000002670000-0x0000000002671000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-98-0x00000000008C0000-0x00000000008C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-99-0x00000000023C0000-0x00000000023C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-100-0x0000000000A00000-0x0000000000A01000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-101-0x00000000022D0000-0x00000000022D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-102-0x0000000002320000-0x0000000002321000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-106-0x00000000001E0000-0x00000000006A9000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2436-105-0x0000000002270000-0x0000000002271000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-103-0x0000000002560000-0x0000000002561000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-104-0x00000000009B0000-0x00000000009B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2436-91-0x00000000001E0000-0x00000000006A9000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2680-41-0x0000000002560000-0x0000000002561000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-284-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-90-0x0000000006E00000-0x00000000072C9000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2680-89-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-72-0x000000000AC90000-0x000000000B14F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-29-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-322-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-320-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-318-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-316-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-314-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-312-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-30-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-60-0x0000000006E00000-0x00000000075A1000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2680-93-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-116-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-46-0x0000000002420000-0x0000000002421000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-126-0x0000000006E00000-0x00000000075A1000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2680-45-0x0000000002A30000-0x0000000002A31000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-43-0x00000000025B0000-0x00000000025B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-44-0x00000000029A0000-0x00000000029A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-32-0x0000000002850000-0x0000000002851000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-33-0x00000000025E0000-0x00000000025E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-34-0x0000000002990000-0x0000000002991000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-35-0x0000000002290000-0x0000000002291000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-299-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-36-0x00000000024D0000-0x00000000024D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-37-0x00000000025C0000-0x00000000025C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-38-0x00000000025D0000-0x00000000025D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-40-0x0000000002480000-0x0000000002481000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-253-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-39-0x0000000002900000-0x0000000002901000-memory.dmp

                            Filesize

                            4KB

                          • memory/2680-276-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-282-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-92-0x0000000006E00000-0x00000000072C9000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/2680-31-0x00000000025F0000-0x00000000025F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2680-293-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2680-297-0x00000000003C0000-0x000000000087F000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2892-173-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-62-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-63-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-61-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-64-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-65-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-67-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-66-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/2892-68-0x00000000009A0000-0x0000000001141000-memory.dmp

                            Filesize

                            7.6MB