Overview

overview

10

Static

static

3

0dfee48d6f...41.exe

windows7-x64

10

0dfee48d6f...41.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 01:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0dfee48d6f0ab22d94eb3e2f045f543e8f9554169730533128425714527fe441.exe

  • Size

    4.6MB

  • MD5

    418d3422db5ec4b85b95647cf1dca1ee

  • SHA1

    fbc3e8cf62c5de0f319a81bb03fbd397487285cf

  • SHA256

    0dfee48d6f0ab22d94eb3e2f045f543e8f9554169730533128425714527fe441

  • SHA512

    678397b004c96113991f733f35a174d76847aae66e846b1e8d8f00d4318814cbbddc7e535c627adb27d028c595aefa753d8c2747bc0621ee1c35ff0051d0526c

  • SSDEEP

    98304:JrtNtkXBS3lfftb2/Jgk+5KwWELBGh+p257hHIsLtvn/4dmDrs4x:lrtk03hfkJgk+5ME9U3XoCtvnEyP

Score
10/10
agentteslagurcuredlinesectopratdiscoveryevasionexecutioninfostealerkeyloggerratspywarestealerthemidatrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7390139954:AAFw-89dzufZnN9iQ-qMJ7xuGsXRrzvXAEI/

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7390139954:AAFw-89dzufZnN9iQ-qMJ7xuGsXRrzvXAEI/sendDocumen

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Redline family
    redline
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 13 IoCs
  • Sectoprat family
    sectoprat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 29 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0dfee48d6f0ab22d94eb3e2f045f543e8f9554169730533128425714527fe441.exe
    "C:\Users\Admin\AppData\Local\Temp\0dfee48d6f0ab22d94eb3e2f045f543e8f9554169730533128425714527fe441.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C wmic path win32_ComputerSystem get model
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_ComputerSystem get model
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2792
    • C:\Users\Admin\AppData\Local\Temp\ARiJxIuyfr\m59NGFc4NGv3cEq.exe
      "C:\Users\Admin\AppData\Local\Temp\ARiJxIuyfr\m59NGFc4NGv3cEq.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ARiJxIuyfr\m59NGFc4NGv3cEq.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1664
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qbBOxcvrRwZ.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2920
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qbBOxcvrRwZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF1C2.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:396
      • C:\Users\Admin\AppData\Local\Temp\ARiJxIuyfr\m59NGFc4NGv3cEq.exe
        "C:\Users\Admin\AppData\Local\Temp\ARiJxIuyfr\m59NGFc4NGv3cEq.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4676
    • C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe
      "C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2248
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kGkrrVBwvWw.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1724
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kGkrrVBwvWw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD31.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:844
      • C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe
        "C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe"
        3⤵
        • Executes dropped EXE
        PID:2104
      • C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe
        "C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe"
        3⤵
        • Executes dropped EXE
        PID:400
      • C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe
        "C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe"
        3⤵
        • Executes dropped EXE
        PID:4024
      • C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe
        "C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:372
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C TIMEOUT /T 3 && DEL /f "C:\Users\Admin\AppData\Local\Temp\0dfee48d6f0ab22d94eb3e2f045f543e8f9554169730533128425714527fe441.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Windows\system32\timeout.exe
        TIMEOUT /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

4
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XDDz4zPtAG5Y1JP.exe.log
    Filesize

    1KB

    MD5

    8ec831f3e3a3f77e4a7b9cd32b48384c

    SHA1

    d83f09fd87c5bd86e045873c231c14836e76a05c

    SHA256

    7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

    SHA512

    26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    c57891ab2e6eacc98b4e0e63fd18b0ce

    SHA1

    19ce78efc6a0c2952639191885f2c3f502c3568e

    SHA256

    8203ca3472ee1a91d659257c3e95164a5ddd67dea39bc7b8a9847efc3bc65c71

    SHA512

    a3f1cc2fbab4d590928f54f9463ce07a0ccf37169408c478ec3a417ab7aa0ea7cf0caa5695b37a1d338d6cc5ce5dc042199d785ed9b3a33a203bee1bed473f83

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    06396ea9ecdaf9125adec93a91eadb19

    SHA1

    adf58afa3318fded3a471dcc1bf7abcb9ccd2f8a

    SHA256

    f9fe3cca52b0500e08b4bdf42f1114b9547821a23b9a364805b9bd49bc101344

    SHA512

    e9206f2dd203a4dcf7f07e9526130cfa423ed9195e270de8589d9cfbe3373da8405485c4fa0fc10796ce3a5097e8e630cbfe882297a27cda1f8036b1ba2e5103

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ARiJxIuyfr\m59NGFc4NGv3cEq.exe
    Filesize

    2.3MB

    MD5

    b556e1671ea4cfdd09a334ba56e3d88d

    SHA1

    6a1e3965c5ce1d343583e9575b39ba4bdc3799c4

    SHA256

    10b424b2ef3c49c855f2ce5163757f726df556aedf621be7d26f1f3669d5b66b

    SHA512

    cd222b1177956b5c93c3b200807f7e876346ad99a5d7a2af3a5fe3fc95dba9b98763ad84ff4a5c3674aaba1a44c1c4d323c72a68b34dccc05a54748e2452766a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\GPrEMLJyZTbv\XDDz4zPtAG5Y1JP.exe
    Filesize

    2.3MB

    MD5

    7a7a7c876f642137056271817db6109a

    SHA1

    0833452d4ca169c1a12ce0ce0ef5f408b510b7f6

    SHA256

    1a1a61ea96f734f572ce0836182585ea0533c87c50a68dccb43d316b4cc250da

    SHA512

    9795110b5dd6f196a48bbfb592b4e8ad02350cc6e5e067586187f0a5991e4d93c9f471fe29b6f8f1c048a3a784ac5bccd249a999fc26f70b58982fa349f9c4fb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p5vksgql.p4a.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp115.tmp
    Filesize

    40KB

    MD5

    a182561a527f929489bf4b8f74f65cd7

    SHA1

    8cd6866594759711ea1836e86a5b7ca64ee8911f

    SHA256

    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

    SHA512

    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp13B.tmp
    Filesize

    114KB

    MD5

    d9f3a549453b94ec3a081feb24927cd7

    SHA1

    1af72767f6dfd1eaf78b899c3ad911cfa3cd09c8

    SHA256

    ff366f2cf27da8b95912968ac830f2db3823f77c342e73ee45ec335dbc2c1a73

    SHA512

    f48765c257e1539cacce536e4f757e3d06388a6e7e6c7f714c3fce2290ce7cdb5f0e8bb8db740b5899ba8b53e2ed8b47e08b0d043bb8df5a660841dc2c204029

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp166.tmp
    Filesize

    48KB

    MD5

    349e6eb110e34a08924d92f6b334801d

    SHA1

    bdfb289daff51890cc71697b6322aa4b35ec9169

    SHA256

    c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

    SHA512

    2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp16C.tmp
    Filesize

    20KB

    MD5

    49693267e0adbcd119f9f5e02adf3a80

    SHA1

    3ba3d7f89b8ad195ca82c92737e960e1f2b349df

    SHA256

    d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

    SHA512

    b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp181.tmp
    Filesize

    116KB

    MD5

    f70aa3fa04f0536280f872ad17973c3d

    SHA1

    50a7b889329a92de1b272d0ecf5fce87395d3123

    SHA256

    8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

    SHA512

    30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp19D.tmp
    Filesize

    96KB

    MD5

    40f3eb83cc9d4cdb0ad82bd5ff2fb824

    SHA1

    d6582ba879235049134fa9a351ca8f0f785d8835

    SHA256

    cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

    SHA512

    cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpDD31.tmp
    Filesize

    1KB

    MD5

    cf3d189a2c0005d95e5f068d3e84a2e5

    SHA1

    0b3a81c49922d3f484026d73d5643eb904690c36

    SHA256

    3abd68c89074356638d8c2a98fee9529a7ce21b20f2d37e65461ba371a0f266a

    SHA512

    7732fb30985a77517669d1a3fa71f4238185531af7e48ce224fc96099f87ffc28b7773caed1d5eedf293416c32c3313c1f95fa92e83d4f990e3e437d11a82648

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpF1C2.tmp
    Filesize

    1KB

    MD5

    653d67748d780895229dcb1568378630

    SHA1

    a331752fb0fa1fb69e2254951a97d14b1d9a6d92

    SHA256

    d368aea6c1144b1259f881dbff11ad72d14404eeabf0fa1560c66acd9d27fa24

    SHA512

    1b1f9a209a0b8feb4e0b7012a5c070d4cc9ff08c19569ada975d97cceb866127745cc8f5aadf08251e98752b41faf431aa5fd7d7cd082bf5706800502f37ab87

    Download Submit

  • memory/372-87-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-197-0x0000000007110000-0x00000000072D2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/372-68-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-71-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-200-0x00000000077E0000-0x00000000077FE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/372-199-0x00000000074A0000-0x0000000007516000-memory.dmp

    Filesize

    472KB

    Download

  • memory/372-79-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-84-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-198-0x0000000007810000-0x0000000007D3C000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/372-91-0x0000000005E30000-0x0000000005F3A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/372-85-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-83-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-82-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-80-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-88-0x00000000061C0000-0x00000000067D8000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/372-81-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-89-0x0000000005B20000-0x0000000005B32000-memory.dmp

    Filesize

    72KB

    Download

  • memory/372-90-0x0000000005BA0000-0x0000000005BDC000-memory.dmp

    Filesize

    240KB

    Download

  • memory/372-78-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-77-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-76-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-74-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/372-75-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1336-32-0x0000000005E70000-0x0000000005F0C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1336-33-0x0000000007030000-0x000000000704E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1336-34-0x000000000C0B0000-0x000000000C2C8000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1336-31-0x0000000005C00000-0x0000000005C0A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1336-30-0x0000000005C40000-0x0000000005CD2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1336-29-0x00000000061F0000-0x0000000006794000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1336-28-0x0000000000FA0000-0x00000000011F0000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1664-193-0x0000000007E00000-0x0000000007E14000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1664-192-0x0000000007DC0000-0x0000000007DD1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1664-171-0x0000000070B00000-0x0000000070B4C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1664-181-0x0000000007A80000-0x0000000007B23000-memory.dmp

    Filesize

    652KB

    Download

  • memory/1664-143-0x0000000006200000-0x0000000006554000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/1724-117-0x0000000007AA0000-0x0000000007AAA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1724-106-0x0000000007A30000-0x0000000007A4A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1724-105-0x0000000008070000-0x00000000086EA000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/1724-104-0x00000000078D0000-0x0000000007973000-memory.dmp

    Filesize

    652KB

    Download

  • memory/1724-120-0x0000000007C60000-0x0000000007C6E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1724-119-0x0000000007C30000-0x0000000007C41000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1724-118-0x0000000007CB0000-0x0000000007D46000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1724-103-0x0000000007660000-0x000000000767E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1724-92-0x0000000007680000-0x00000000076B2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1724-93-0x0000000070B00000-0x0000000070B4C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1724-73-0x0000000006770000-0x00000000067BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1724-72-0x00000000066E0000-0x00000000066FE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1724-46-0x00000000060F0000-0x0000000006444000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2248-41-0x0000000005530000-0x0000000005B58000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/2248-121-0x0000000007980000-0x0000000007994000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2248-43-0x0000000005B60000-0x0000000005BC6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2248-42-0x0000000005440000-0x0000000005462000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2248-40-0x0000000002B10000-0x0000000002B46000-memory.dmp

    Filesize

    216KB

    Download

  • memory/2248-122-0x0000000007A80000-0x0000000007A9A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2248-107-0x0000000070B00000-0x0000000070B4C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2248-123-0x0000000007A60000-0x0000000007A68000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2248-44-0x0000000005BD0000-0x0000000005C36000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2920-182-0x0000000070B00000-0x0000000070B4C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2980-27-0x00000000006C0000-0x0000000000918000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2980-35-0x000000000B330000-0x000000000B54E000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3992-0-0x00007FF8E41C3000-0x00007FF8E41C5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3992-1-0x0000000000640000-0x0000000000AE4000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/4676-155-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-159-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-158-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-160-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-161-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-163-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-164-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-166-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-170-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-168-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-167-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-162-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-165-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-153-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4676-355-0x0000000007040000-0x0000000007090000-memory.dmp

    Filesize

    320KB

    Download