Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

6a5aaed471...d2.exe

windows7-x64

10

6a5aaed471...d2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 02:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6a5aaed4715d3e77d6ed09d884e84427e5503e13d047f6aeecf14422e19d28d2.exe

  • Size

    3.1MB

  • MD5

    03230709a389833c86b1815d9528f174

  • SHA1

    92af669ecd7050500c2a2444648e10c5cde0eafa

  • SHA256

    6a5aaed4715d3e77d6ed09d884e84427e5503e13d047f6aeecf14422e19d28d2

  • SHA512

    24b8189d48a46b6ea7fe019a71feb7496acc61a589a0dadca489db2eabb7d858f7e81c890285045a9dddf4c65ce7fa5caf3e7f9cfcc95d297069cde1919f6606

  • SSDEEP

    49152:cwQMSR880gYoljfq2fXqWMA7FaonbmBT:AR880gYwjC0a+

Score
10/10
amadeylummastealcxmrig9c9aa5talediscoveryevasionexecutionminerpersistencestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://navygenerayk.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 17 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a5aaed4715d3e77d6ed09d884e84427e5503e13d047f6aeecf14422e19d28d2.exe
    "C:\Users\Admin\AppData\Local\Temp\6a5aaed4715d3e77d6ed09d884e84427e5503e13d047f6aeecf14422e19d28d2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1852
        • C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe
          "C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"
          4⤵
          • Executes dropped EXE
          PID:1928
        • C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe
          "C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:2008
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 100
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2800
      • C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe
        "C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe"
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2508
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1564
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2404
          • C:\Windows\system32\wusa.exe
            wusa /uninstall /kb:890830 /quiet /norestart
            5⤵
            • Drops file in Windows directory
            PID:1596
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          4⤵
          • Launches sc.exe
          PID:1952
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          4⤵
          • Launches sc.exe
          PID:1208
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          4⤵
          • Launches sc.exe
          PID:1840
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          4⤵
          • Launches sc.exe
          PID:1548
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          4⤵
          • Launches sc.exe
          PID:1780
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:772
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:2464
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:808
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "GDRQRNRG"
          4⤵
          • Launches sc.exe
          PID:1224
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "GDRQRNRG" binpath= "C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe" start= "auto"
          4⤵
          • Launches sc.exe
          PID:2644
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          4⤵
          • Launches sc.exe
          PID:352
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "GDRQRNRG"
          4⤵
          • Launches sc.exe
          PID:1640
      • C:\Users\Admin\AppData\Local\Temp\1004976001\4cd7dd2fc8.exe
        "C:\Users\Admin\AppData\Local\Temp\1004976001\4cd7dd2fc8.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2568
      • C:\Users\Admin\AppData\Local\Temp\1004977001\15058fae3e.exe
        "C:\Users\Admin\AppData\Local\Temp\1004977001\15058fae3e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:664
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
          PID:2104
        • C:\Users\Admin\AppData\Local\Temp\1004979001\95176787bb.exe
          "C:\Users\Admin\AppData\Local\Temp\1004979001\95176787bb.exe"
          3⤵
          • Modifies Windows Defender Real-time Protection settings
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Windows security modification
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2944
    • C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe
      C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe
      1⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2532
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
          • Drops file in Windows directory
          PID:1660
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop UsoSvc
        2⤵
        • Launches sc.exe
        PID:2292
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        2⤵
        • Launches sc.exe
        PID:1656
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop wuauserv
        2⤵
        • Launches sc.exe
        PID:1064
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop bits
        2⤵
        • Launches sc.exe
        PID:2352
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop dosvc
        2⤵
        • Launches sc.exe
        PID:1644
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:332
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2144
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:1880
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2732
      • C:\Windows\system32\conhost.exe
        C:\Windows\system32\conhost.exe
        2⤵
          PID:2752
        • C:\Windows\system32\notepad.exe
          notepad.exe
          2⤵
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2652

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      System Services

      2
      T1569

      Service Execution

      2
      T1569.002

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      3
      T1543

      Windows Service

      3
      T1543.003

      Power Settings

      1
      T1653

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      3
      T1543

      Windows Service

      3
      T1543.003

      Defense Evasion

      Impair Defenses

      3
      T1562

      Disable or Modify Tools

      2
      T1562.001

      Modify Registry

      4
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Service Stop

      1
      T1489

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe
        Filesize

        1.2MB

        MD5

        e1d09be68de1be491cdb2870bfc90854

        SHA1

        6db8265a53f1a9e9d0c4aa8f98ade1db4eea9109

        SHA256

        6b2c384e64992914ec049762e153d4592c7dc2511b8cc079843c4d8195210c23

        SHA512

        10e609c166adfe9aebb5c62f57896fc194d5272f5b82c2cd8f3719444074bd0064e7969a559633b4d7b000b5196812ea38c913bf970cfd4c33567116d8295692

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe
        Filesize

        6.9MB

        MD5

        ce3a6f4d1ebe823841187d30e9f143ab

        SHA1

        7316c51c0539724130226dd5cdc968b67415e225

        SHA256

        98d0e67d779ed43bcac753a9af22326e0024390d703c7c4e6601917ce6ff96bc

        SHA512

        cfdddc6575138fb500d8e7e4ca379091d96864e4bf60fbcc357a0275b68f67210757204b86c983465959dd115e1b3944d22f410fec3f7232f2b6bda187df171a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004976001\4cd7dd2fc8.exe
        Filesize

        3.1MB

        MD5

        89a160565c7bebd7b85b15bc147aaaad

        SHA1

        e2dbb58ecac86e66059367f4530b82e1e9648278

        SHA256

        42062d89ef76e8e45f444f0d378bb63fbec20c6b10b5273461b0328fdb350865

        SHA512

        6328c30a325bf3b4f760105adf617e890cd7a8ec2ed5a8593ef41e850eeb4e920e12fc5f905ab6e56dda5a2e7dbd2d5f47de0c9b9a268a89a9570a997f8a4f10

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004977001\15058fae3e.exe
        Filesize

        2.0MB

        MD5

        007a9527bf23925597d5f273a2d1e256

        SHA1

        a9a7a52379bce50b8713596ba3eddf9b90fd1ccc

        SHA256

        ce7019c8e57824b533093e62cd1ba961cc2c7e8510cbaa0072f8a85977d53694

        SHA512

        b13a5f34c0c3dfa385bfedd8f2e0e8c1c6016084b4a7900b0ff0ab5214496428334c070762a6523cb3b404bdfc86aa1a9f47e157b48a23d31b2aea93c348ebc1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1004979001\95176787bb.exe
        Filesize

        2.7MB

        MD5

        8f83afca9c2c5f691e0d72198fc243eb

        SHA1

        fb78a4d64c193fdf5a8da774bc217b0d53f4e567

        SHA256

        eca345932d6d86344eeff06cb9b3d60131d23f48f59a5dd73fec57734bba3e01

        SHA512

        15c690eedd848bf377b0c2a2dddaea5f90e1fae50ab20ed4d2fd61c7d57d1b070df5f1d5b6258f89aabbda2fd0661e2861bff273474c9aa4fa68fcc08a7203bc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab17B7.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar17CA.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        Filesize

        3.1MB

        MD5

        03230709a389833c86b1815d9528f174

        SHA1

        92af669ecd7050500c2a2444648e10c5cde0eafa

        SHA256

        6a5aaed4715d3e77d6ed09d884e84427e5503e13d047f6aeecf14422e19d28d2

        SHA512

        24b8189d48a46b6ea7fe019a71feb7496acc61a589a0dadca489db2eabb7d858f7e81c890285045a9dddf4c65ce7fa5caf3e7f9cfcc95d297069cde1919f6606

        Download Submit

      • memory/664-168-0x00000000010A0000-0x00000000017D7000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/664-167-0x00000000010A0000-0x00000000017D7000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/1564-201-0x000000001B610000-0x000000001B8F2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/1564-202-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1852-43-0x0000000001132000-0x0000000001133000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2008-50-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2008-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2008-59-0x0000000001050000-0x0000000001187000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/2008-46-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2008-47-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2008-56-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2008-55-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2008-48-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2008-49-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

        Download

      • memory/2508-171-0x000000013F730000-0x0000000140180000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2508-148-0x000000013F730000-0x0000000140180000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2508-124-0x000000013F730000-0x0000000140180000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2508-196-0x000000013F730000-0x0000000140180000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2508-205-0x000000013F730000-0x0000000140180000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2568-145-0x0000000001190000-0x00000000014A1000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2568-169-0x0000000001190000-0x00000000014A1000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-61-0x0000000000391000-0x00000000003F9000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2588-142-0x0000000006630000-0x0000000006941000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-66-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-67-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-64-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-63-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-102-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-103-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-104-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-105-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-106-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-107-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-62-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-123-0x0000000006D50000-0x00000000077A0000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2588-246-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-125-0x0000000006D50000-0x00000000077A0000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2588-126-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-32-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-143-0x0000000006630000-0x0000000006941000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-195-0x0000000006630000-0x0000000006944000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-23-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-147-0x0000000006D50000-0x00000000077A0000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2588-21-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-20-0x0000000000391000-0x00000000003F9000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2588-165-0x0000000006D50000-0x0000000007487000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2588-18-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-166-0x0000000006D50000-0x0000000007487000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2588-245-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-244-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-170-0x0000000006630000-0x0000000006941000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-243-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-174-0x0000000006630000-0x0000000006944000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-175-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-176-0x0000000006630000-0x0000000006941000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-237-0x0000000006630000-0x00000000068EA000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2588-65-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2588-191-0x0000000006D50000-0x0000000007487000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/2588-189-0x0000000006630000-0x00000000068EA000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2588-209-0x0000000000390000-0x00000000006A4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2652-230-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-238-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-224-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-226-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-227-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-229-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-231-0x00000000001B0000-0x00000000001D0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2652-222-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-235-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-232-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-233-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-223-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-236-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-239-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2652-234-0x0000000140000000-0x0000000140848000-memory.dmp

        Filesize

        8.3MB

        Download

      • memory/2684-17-0x0000000000BB0000-0x0000000000EC4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2684-14-0x00000000064C0000-0x00000000067D4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2684-19-0x0000000000BB1000-0x0000000000C19000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2684-0-0x0000000000BB0000-0x0000000000EC4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2684-1-0x0000000077D00000-0x0000000077D02000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2684-9-0x0000000000BB0000-0x0000000000EC4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2684-2-0x0000000000BB1000-0x0000000000C19000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2684-3-0x0000000000BB0000-0x0000000000EC4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2684-5-0x0000000000BB0000-0x0000000000EC4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2708-211-0x000000001A0E0000-0x000000001A3C2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2708-212-0x0000000000940000-0x0000000000948000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2752-213-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2752-214-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2752-218-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2752-215-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2752-216-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2752-220-0x0000000140000000-0x000000014000E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2944-194-0x00000000001A0000-0x000000000045A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2944-192-0x00000000001A0000-0x000000000045A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2944-242-0x00000000001A0000-0x000000000045A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2944-193-0x00000000001A0000-0x000000000045A000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2972-228-0x000000013F970000-0x00000001403C0000-memory.dmp

        Filesize

        10.3MB

        Download

      • memory/2972-210-0x000000013F970000-0x00000001403C0000-memory.dmp

        Filesize

        10.3MB

        Download