Overview

overview

10

Static

static

3

0bc54a76b0...3N.exe

windows7-x64

10

0bc54a76b0...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 02:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363N.exe

  • Size

    3.1MB

  • MD5

    5c87bc7b86c06bb8cd470891009473f0

  • SHA1

    5206f5d15901d89f85e8eaffb3c769c157b0718f

  • SHA256

    0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363

  • SHA512

    c4d9f94f58f19c3cadfa0eff7651dcf0c6ef3278848b53a4bb4b5aee19c8442248f233d22256eaf5f1f5e107d635623f8eb5598f3e8bdd3c209b9b6f27d6365a

  • SSDEEP

    49152:uOYlNL4bhn1aqOU0y3xLYSFNo822Vy8cFGmrt0uU:8Nsbhn5OUh3xLYSD20y7B

Score
10/10
amadeylummastealcxmrig9c9aa5talediscoveryevasionexecutionminerpersistencestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://navygenerayk.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 16 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363N.exe
    "C:\Users\Admin\AppData\Local\Temp\0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe
          "C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:2004
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 92
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2924
      • C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe
        "C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe"
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2216
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2920
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2252
          • C:\Windows\system32\wusa.exe
            wusa /uninstall /kb:890830 /quiet /norestart
            5⤵
            • Drops file in Windows directory
            PID:2248
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          4⤵
          • Launches sc.exe
          PID:748
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          4⤵
          • Launches sc.exe
          PID:600
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          4⤵
          • Launches sc.exe
          PID:2492
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          4⤵
          • Launches sc.exe
          PID:408
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          4⤵
          • Launches sc.exe
          PID:2960
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1848
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1696
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1764
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1676
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "GDRQRNRG"
          4⤵
          • Launches sc.exe
          PID:2096
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "GDRQRNRG" binpath= "C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe" start= "auto"
          4⤵
          • Launches sc.exe
          PID:2552
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          4⤵
          • Launches sc.exe
          PID:2192
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "GDRQRNRG"
          4⤵
          • Launches sc.exe
          PID:1688
      • C:\Users\Admin\AppData\Local\Temp\1004972001\6827e29568.exe
        "C:\Users\Admin\AppData\Local\Temp\1004972001\6827e29568.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2512
      • C:\Users\Admin\AppData\Local\Temp\1004973001\2b14204357.exe
        "C:\Users\Admin\AppData\Local\Temp\1004973001\2b14204357.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2788
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
          PID:2372
        • C:\Users\Admin\AppData\Local\Temp\1004975001\26a411b40c.exe
          "C:\Users\Admin\AppData\Local\Temp\1004975001\26a411b40c.exe"
          3⤵
          • Modifies Windows Defender Real-time Protection settings
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Windows security modification
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2116
    • C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe
      C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe
      1⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2388
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
          • Drops file in Windows directory
          PID:1692
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop UsoSvc
        2⤵
        • Launches sc.exe
        PID:3004
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        2⤵
        • Launches sc.exe
        PID:1592
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop wuauserv
        2⤵
        • Launches sc.exe
        PID:2876
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop bits
        2⤵
        • Launches sc.exe
        PID:1812
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop dosvc
        2⤵
        • Launches sc.exe
        PID:2748
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2628
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2276
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2768
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
      • C:\Windows\system32\conhost.exe
        C:\Windows\system32\conhost.exe
        2⤵
          PID:1924
        • C:\Windows\system32\notepad.exe
          notepad.exe
          2⤵
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2940

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      System Services

      2
      T1569

      Service Execution

      2
      T1569.002

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      3
      T1543

      Windows Service

      3
      T1543.003

      Power Settings

      1
      T1653

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      3
      T1543

      Windows Service

      3
      T1543.003

      Defense Evasion

      Impair Defenses

      3
      T1562

      Disable or Modify Tools

      2
      T1562.001

      Modify Registry

      4
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Service Stop

      1
      T1489

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe
        Filesize

        1.2MB

        MD5

        e1d09be68de1be491cdb2870bfc90854

        SHA1

        6db8265a53f1a9e9d0c4aa8f98ade1db4eea9109

        SHA256

        6b2c384e64992914ec049762e153d4592c7dc2511b8cc079843c4d8195210c23

        SHA512

        10e609c166adfe9aebb5c62f57896fc194d5272f5b82c2cd8f3719444074bd0064e7969a559633b4d7b000b5196812ea38c913bf970cfd4c33567116d8295692

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe
        Filesize

        6.9MB

        MD5

        ce3a6f4d1ebe823841187d30e9f143ab

        SHA1

        7316c51c0539724130226dd5cdc968b67415e225

        SHA256

        98d0e67d779ed43bcac753a9af22326e0024390d703c7c4e6601917ce6ff96bc

        SHA512

        cfdddc6575138fb500d8e7e4ca379091d96864e4bf60fbcc357a0275b68f67210757204b86c983465959dd115e1b3944d22f410fec3f7232f2b6bda187df171a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004972001\6827e29568.exe
        Filesize

        3.0MB

        MD5

        bb610f3b68a61a23e8d71c8fad693f38

        SHA1

        b077edd1521904673b7dd7f01d45e7aa3cbce4fb

        SHA256

        1ad85e7a7ae029b5d4003420b6912a51fcefc95f6b7f64fabc2783e10286857a

        SHA512

        9353f34e693fc2bbcf7da5ce3f9d3382262786ccaf763a00b3a874949f6e17beca912a61f144dc0fb6e7a2794e53721d3631c84b5a4afccfd679cb0974d9c914

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004973001\2b14204357.exe
        Filesize

        2.1MB

        MD5

        f058a72e4dbe19f8b8ffb8785c2820d2

        SHA1

        440c44260ad8564a776ec1292adc4577906009fe

        SHA256

        6a443c0ac67ec4aff6acb6319cfc04d68bf0f861ac0424dec70a6bb8a27975cb

        SHA512

        bb2068d16c5f8a02aa2df1d51b491fb48de7a47cf74bb69e1ea20feb5b33f529d8e2d0b36844fa6ce961aa3c6337c057af7533153209cf26b4db6b7cd30d23ea

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004975001\26a411b40c.exe
        Filesize

        2.7MB

        MD5

        8f83afca9c2c5f691e0d72198fc243eb

        SHA1

        fb78a4d64c193fdf5a8da774bc217b0d53f4e567

        SHA256

        eca345932d6d86344eeff06cb9b3d60131d23f48f59a5dd73fec57734bba3e01

        SHA512

        15c690eedd848bf377b0c2a2dddaea5f90e1fae50ab20ed4d2fd61c7d57d1b070df5f1d5b6258f89aabbda2fd0661e2861bff273474c9aa4fa68fcc08a7203bc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\CabAEB8.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TarAECB.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        Filesize

        3.1MB

        MD5

        5c87bc7b86c06bb8cd470891009473f0

        SHA1

        5206f5d15901d89f85e8eaffb3c769c157b0718f

        SHA256

        0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363

        SHA512

        c4d9f94f58f19c3cadfa0eff7651dcf0c6ef3278848b53a4bb4b5aee19c8442248f233d22256eaf5f1f5e107d635623f8eb5598f3e8bdd3c209b9b6f27d6365a

        Download Submit

      • memory/1924-212-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1924-214-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1924-213-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1924-217-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1924-211-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1924-215-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2004-52-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2004-56-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2004-60-0x0000000001230000-0x0000000001367000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/2004-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2004-49-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2004-47-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2004-45-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2004-43-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2004-41-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2116-239-0x0000000000B70000-0x0000000000E2A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2116-192-0x0000000000B70000-0x0000000000E2A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2116-190-0x0000000000B70000-0x0000000000E2A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2116-242-0x0000000000B70000-0x0000000000E2A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2116-191-0x0000000000B70000-0x0000000000E2A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2216-172-0x000000013FBD0000-0x0000000140620000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2216-163-0x000000013FBD0000-0x0000000140620000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2216-124-0x000000013FBD0000-0x0000000140620000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2216-204-0x000000013FBD0000-0x0000000140620000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2316-2-0x0000000001171000-0x00000000011D9000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2316-15-0x00000000068F0000-0x0000000006C0B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2316-18-0x0000000001171000-0x00000000011D9000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2316-14-0x0000000001170000-0x000000000148B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2316-5-0x0000000001170000-0x000000000148B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2316-3-0x0000000001170000-0x000000000148B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2316-0-0x0000000001170000-0x000000000148B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2316-1-0x0000000077900000-0x0000000077902000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2388-209-0x0000000019E80000-0x000000001A162000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2388-210-0x0000000000930000-0x0000000000938000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2512-155-0x0000000000820000-0x0000000000B2C000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/2512-142-0x0000000000820000-0x0000000000B2C000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/2528-208-0x000000013FBD0000-0x0000000140620000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2528-224-0x000000013FBD0000-0x0000000140620000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2636-97-0x0000000000031000-0x0000000000099000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2636-19-0x0000000000031000-0x0000000000099000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2636-123-0x0000000006910000-0x0000000007360000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2636-122-0x0000000006910000-0x0000000007360000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2636-106-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-243-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-164-0x0000000006910000-0x000000000704E000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2636-17-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-169-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-173-0x00000000062F0000-0x000000000660B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-105-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-174-0x00000000062F0000-0x00000000065FC000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/2636-175-0x00000000062F0000-0x00000000065FC000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/2636-104-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-103-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-189-0x00000000062F0000-0x00000000065AA000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2636-102-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-101-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-193-0x0000000006910000-0x000000000704E000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2636-194-0x0000000006910000-0x000000000704E000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2636-62-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-238-0x00000000062F0000-0x00000000065AA000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2636-100-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-145-0x0000000006910000-0x0000000007360000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2636-98-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-141-0x00000000062F0000-0x00000000065FC000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/2636-99-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-146-0x0000000006910000-0x0000000007360000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2636-59-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-20-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-22-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2636-143-0x00000000062F0000-0x00000000065FC000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/2636-230-0x0000000000030000-0x000000000034B000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2788-166-0x00000000012C0000-0x00000000019FE000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2788-168-0x00000000012C0000-0x00000000019FE000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2852-54-0x0000000001312000-0x0000000001313000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2920-199-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2920-200-0x0000000001D60000-0x0000000001D68000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2940-225-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-220-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-234-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-232-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-227-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-228-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-226-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-235-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-233-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-236-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-237-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-231-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-222-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-221-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2940-229-0x00000000000B0000-0x00000000000D0000-memory.dmp

        Filesize

        128KB

        Download