Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 18:54

General

  • Target

    659d7e5771dda39e290d348369a4435ca1fce155f4ca4046c2a99971977bed7a.exe

  • Size

    3.1MB

  • MD5

    362a4465a166f5d70e2ba682775650af

  • SHA1

    33c190442e962c06b0824e9f264f49544bf94e2d

  • SHA256

    659d7e5771dda39e290d348369a4435ca1fce155f4ca4046c2a99971977bed7a

  • SHA512

    86030428139d02ae0bdde34fd3408a4c8f884aa8b624325f4a744e4c0ee43955e60d29c98669531fd8e3e97a40070e641470cc5bd2b188461b9bf53c3f978028

  • SSDEEP

    49152:Md2Jqc3DQ1r/lkHFbNJyyEr2BxMzZ/yV8FHAZUzyl2iT5Oc8:Md2J13DQ1r/lkHFRJ8rN/yV8+Zce5Q

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://thicktoys.sbs/api

https://3xc1aimbl0w.sbs/api

https://300snails.sbs/api

https://faintbl0w.sbs/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 11 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\659d7e5771dda39e290d348369a4435ca1fce155f4ca4046c2a99971977bed7a.exe
        "C:\Users\Admin\AppData\Local\Temp\659d7e5771dda39e290d348369a4435ca1fce155f4ca4046c2a99971977bed7a.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2228
          • C:\Users\Admin\AppData\Local\Temp\1005627001\oi.exe
            "C:\Users\Admin\AppData\Local\Temp\1005627001\oi.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1340
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2860
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1592
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa opssvc"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2560
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:980
              • C:\Windows\SysWOW64\findstr.exe
                findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:580
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 27375
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2908
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "optimizationsquarerehabseq" Tech
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2440
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Maintained + ..\Bryan + ..\Ace + ..\Stored + ..\Concerts + ..\Tiny + ..\Simplified G
                6⤵
                • System Location Discovery: System Language Discovery
                PID:388
              • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                Lovely.pif G
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2520
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks.exe /create /tn "ZenFlow" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc onlogon /F /RL HIGHEST
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:1668
                • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  PID:2936
                • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1604
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 15
                6⤵
                • System Location Discovery: System Language Discovery
                PID:632
          • C:\Users\Admin\AppData\Local\Temp\1005796001\ba7b87d0cd.exe
            "C:\Users\Admin\AppData\Local\Temp\1005796001\ba7b87d0cd.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2188
          • C:\Users\Admin\AppData\Local\Temp\1005797001\167434267f.exe
            "C:\Users\Admin\AppData\Local\Temp\1005797001\167434267f.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2488
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            4⤵
              PID:2448
            • C:\Users\Admin\AppData\Local\Temp\1005799001\27ffd80b8e.exe
              "C:\Users\Admin\AppData\Local\Temp\1005799001\27ffd80b8e.exe"
              4⤵
              • Modifies Windows Defender Real-time Protection settings
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Windows security modification
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2300
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c schtasks.exe /create /tn "Total" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2012
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /create /tn "Total" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2820

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\1005627001\oi.exe

              Filesize

              1009KB

              MD5

              bd9ea2886936f3013285b983c3c1537e

              SHA1

              c92073e3457e9fc787a2c2757745e92c949a0668

              SHA256

              bb653dddd858f686a07ac236a6098d9da8dcb8524aedc8da2cb5a6f084cbfebc

              SHA512

              6cd0fdd4d89edb60ffae53f0245d188b8400d71ff2d0fdfba7e0255c2e6a94d327fe5b290abe984022652a7f2875bdbf33b82dcff9b30ed7fa0cb0591e68275a

            • C:\Users\Admin\AppData\Local\Temp\1005796001\ba7b87d0cd.exe

              Filesize

              3.0MB

              MD5

              6fddc2de16b4e52b683845b0de57d268

              SHA1

              79913b66c543fc2242de513e396bfada051ea9c1

              SHA256

              df5d157f42f8ae124e54ff65eba0d51c8e4ffa8c74314ba2ca78ea0e7d18235d

              SHA512

              d585321d10378ddfc341350c54b7643b2caf1be578d1b643496bfa3ec9529769017d015192c17791bd699b830e2fb2b5da626744d3a7cd970f8c0f803f28d2d4

            • C:\Users\Admin\AppData\Local\Temp\1005797001\167434267f.exe

              Filesize

              1.7MB

              MD5

              a7a538f9209ff08114a5c40772fc0f9d

              SHA1

              a7f2bdaa46a30fe022e8eec4be3d04cdae781ea3

              SHA256

              b028bb36409238d9d8f25c5e7c7bcdec533719914ec6e1f66aff34ad04a535f2

              SHA512

              905bd30e78d6f7826dbf89b76dca31466e2eb40ee0ca1f0b7d5830a8d449b82047ba032811cc762f1b50d78789d6fa243d665563c8f6fe92375b4b8632f66957

            • C:\Users\Admin\AppData\Local\Temp\1005799001\27ffd80b8e.exe

              Filesize

              2.7MB

              MD5

              70353d6edaabb73111998005887065a2

              SHA1

              24c11a3cc97d2c268590079b95313915094cb3f7

              SHA256

              71ab44d451b7c3154b631e47e06a0c93df237b1e9e06de637f38546196e27cc9

              SHA512

              a4b39e0a596cbda7d4658b47528f911c4582c35cdd8c578e676cac6e50ff81680779c95df265785e54dfe73e98d6f774dd7c6fdb385228cfc74dff94f2b32045

            • C:\Users\Admin\AppData\Local\Temp\27375\G

              Filesize

              518KB

              MD5

              4119ef62bcd358ce3eeb9242067b201b

              SHA1

              5d4d94fd119aa6223af089b174c0cf475dbfd7a7

              SHA256

              10bcb2925540219372c72f31dd5766be5850ff2a993ada75f73c8ab429aea077

              SHA512

              1b98598039373301cdea25615889b303526ec14b25a34db978f2ed0d5fdfa8e9a6d2d4fec0ff814de6c6482808f2c99593d542f12b14af8e0450c6f48191c890

            • C:\Users\Admin\AppData\Local\Temp\Ace

              Filesize

              86KB

              MD5

              a2051ab029f76a13f21d1ee9e1d13fdb

              SHA1

              f6d2ce4554d8aa45623b4474a36cba2e2f55dbb5

              SHA256

              6c9a4bce60a8b019f5b74cc9861ed3da801ecc7127e4fb8199ff310274e6a6db

              SHA512

              ece6bfcc0d17c9cf06058db6df98de618892ee416f89024e20bed27a387cbebc7158e1db51133f66d1aef6fcc07c4c1f97bd5d821f2638d614f85f7d08e3e95c

            • C:\Users\Admin\AppData\Local\Temp\Advertiser

              Filesize

              909KB

              MD5

              b2f00d6517111c40a399acc3193a9847

              SHA1

              6c754fc2edb87e6d29b6d5938a7710e6a17c5201

              SHA256

              f3df9dd5028e882d651cc871a673f9811b15114e8915375b93bc72b6b93e2733

              SHA512

              1855cd164f00f201105abf906ca4d9acb48adc4c3cde7cb4e1e86293d8b0bb95f3e6d73742102f0cfd030746497be80383abf47c499cd5b91cc0342f0ced2ebf

            • C:\Users\Admin\AppData\Local\Temp\Bryan

              Filesize

              84KB

              MD5

              2b8f2f734ba41de74b0f2ad8c4635807

              SHA1

              c8fde4793ee88811482aa8b8810505fcf978c185

              SHA256

              d62ef368aca33c0c7503b469a5701919cc8524310c624182f5243c913d33ca70

              SHA512

              6e6bbc71fc96d7f364ddbfb2165f8e6fc7875e966b36bfcaa622a37f70e59bc571d446ed934d1805e9d70db2fbd93fa8594bb972a1ee8e3f46da39894b887191

            • C:\Users\Admin\AppData\Local\Temp\Cab3044.tmp

              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            • C:\Users\Admin\AppData\Local\Temp\Concerts

              Filesize

              98KB

              MD5

              8d1261afc55e57b8e4d1fbd56fa3c609

              SHA1

              cd872e347a2c66f7d4549092362a8db6d2674a30

              SHA256

              d5d97b1f80d3680d5177cecb173bb7032379e7e8afa4763a09b7cc00b511ea8c

              SHA512

              a1a5f4b18d59bf89a9af298b7d8c5273d14f73094230be4e71efb05b3d940e68ef48a4e043ca11cda579a13d6091dc42e763443d9d8636ae9ad1d8f1102aa79b

            • C:\Users\Admin\AppData\Local\Temp\Maintained

              Filesize

              88KB

              MD5

              02efef57945fdfa1228bb81d764fcaa9

              SHA1

              3544c446eba2ea13df24eaee4854bd9ec50eb911

              SHA256

              a843a39f214722b5e878a6c29114b9e71efe5842147f2e79dfa48ae762430679

              SHA512

              67e15b531213cb19080a26ba61281ddc9db5e1a8f1125241d34eca4097cf020081827d3f63c49b3ac6d4b1e651c0bf7af0c96f461d312470e5946830d974ff7d

            • C:\Users\Admin\AppData\Local\Temp\Simplified

              Filesize

              22KB

              MD5

              e2fa682e3bbba82ad68e3a8770751da2

              SHA1

              2a22006385ee1386d8ab359e45794e043ea73845

              SHA256

              f5c0563e8cb841e8ca1b1480eb512334f1a9c4f0172a21d39514c37d4c6eb8af

              SHA512

              b829346501967a932fa72b41d19687217ca042fe8fee5d92f3361f32057c0aae011b6457d30dcf030ba7a2ca2e6613182edc79f91f2e560233dda26fb0717994

            • C:\Users\Admin\AppData\Local\Temp\Stored

              Filesize

              72KB

              MD5

              4968ca19c1e07ca817149225f5fdae4a

              SHA1

              5eb15169a968ea921edf0a88cb2a0f501ad108c1

              SHA256

              144ad9f5e00905fe457459e5501b341e1523d37c6a5947efe2a12e01c103ca21

              SHA512

              9fbb0e5b0c27ee7770cdc51e5d249cd522dbd4fa8d87e20d9d253ec4bd6dbc18f4b4433fec415bf1dd42801ed5466624cde34b481533d898905aef506cd77c00

            • C:\Users\Admin\AppData\Local\Temp\Tar3112.tmp

              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

            • C:\Users\Admin\AppData\Local\Temp\Tech

              Filesize

              12KB

              MD5

              c190bf2940b6c8bca86355ca1f5d100f

              SHA1

              1b6694187b834041aa2e3577e47ebdfebd9dc9de

              SHA256

              24c658f99200081bceae83740631ab7326b8a328f23364104c9e534d191ffb28

              SHA512

              01a253b228778be835e619b8b1f4e08ed22c095cd7e935421065bef0acd91fd6089f4b6d3edaa43aa7bdf73d127e7af312feb0a7c0035aedbce48486b334326d

            • C:\Users\Admin\AppData\Local\Temp\Tiny

              Filesize

              68KB

              MD5

              45bc518ce494d5b80c2b6af80adff8bb

              SHA1

              7defa2817736bacca12072ca858d61064bbde5a3

              SHA256

              0cd19abfc3719aaf60e84529980afb15b58e753980b9d089dff32913a9b8e88b

              SHA512

              a12cad7b9f58d2897b46c9bbfc361c861f2586177e8a1cbadb74d1b33d32e7a71af69e123bf7d807a4ec39e54cf1414663a508979b23b4c36344a52d481f2f5f

            • C:\Users\Admin\AppData\Local\Temp\Uh

              Filesize

              12KB

              MD5

              a26452a5a6b681e1680ff91ddcfa2c5c

              SHA1

              7fe7878abf2f3d5ec30bac96bb32db574416edb5

              SHA256

              717fb7062ce364fbb54c89e1aba5a0de1e3bf3bc239b6c6cdc4972aa6f96fee3

              SHA512

              8a3e5ab0aef13f066280d58063af9a34a9df2053dc417224c57ffa7a174e9ab253ca38efba4753c18d2e1130f8a60a030713b4446c44472e71335386e93f4e08

            • \Users\Admin\AppData\Local\Temp\27375\Lovely.pif

              Filesize

              921KB

              MD5

              78ba0653a340bac5ff152b21a83626cc

              SHA1

              b12da9cb5d024555405040e65ad89d16ae749502

              SHA256

              05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

              SHA512

              efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

            • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

              Filesize

              3.1MB

              MD5

              362a4465a166f5d70e2ba682775650af

              SHA1

              33c190442e962c06b0824e9f264f49544bf94e2d

              SHA256

              659d7e5771dda39e290d348369a4435ca1fce155f4ca4046c2a99971977bed7a

              SHA512

              86030428139d02ae0bdde34fd3408a4c8f884aa8b624325f4a744e4c0ee43955e60d29c98669531fd8e3e97a40070e641470cc5bd2b188461b9bf53c3f978028

            • memory/2084-3-0x0000000001020000-0x000000000133C000-memory.dmp

              Filesize

              3.1MB

            • memory/2084-1-0x0000000001020000-0x000000000133C000-memory.dmp

              Filesize

              3.1MB

            • memory/2084-4-0x0000000001020000-0x000000000133C000-memory.dmp

              Filesize

              3.1MB

            • memory/2084-0-0x0000000001020000-0x000000000133C000-memory.dmp

              Filesize

              3.1MB

            • memory/2084-2-0x0000000001020000-0x000000000133C000-memory.dmp

              Filesize

              3.1MB

            • memory/2084-14-0x00000000068C0000-0x0000000006BDC000-memory.dmp

              Filesize

              3.1MB

            • memory/2084-16-0x0000000001020000-0x000000000133C000-memory.dmp

              Filesize

              3.1MB

            • memory/2188-444-0x0000000000E00000-0x00000000010FE000-memory.dmp

              Filesize

              3.0MB

            • memory/2228-380-0x0000000006B10000-0x0000000006E0E000-memory.dmp

              Filesize

              3.0MB

            • memory/2228-446-0x0000000006B10000-0x0000000006E0E000-memory.dmp

              Filesize

              3.0MB

            • memory/2228-39-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-38-0x0000000000231000-0x0000000000299000-memory.dmp

              Filesize

              416KB

            • memory/2228-24-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-381-0x0000000006B10000-0x0000000006E0E000-memory.dmp

              Filesize

              3.0MB

            • memory/2228-23-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-22-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-499-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-401-0x0000000006B10000-0x0000000007196000-memory.dmp

              Filesize

              6.5MB

            • memory/2228-399-0x0000000006B10000-0x0000000007196000-memory.dmp

              Filesize

              6.5MB

            • memory/2228-498-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-20-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-412-0x0000000006B10000-0x0000000006E0E000-memory.dmp

              Filesize

              3.0MB

            • memory/2228-19-0x0000000000231000-0x0000000000299000-memory.dmp

              Filesize

              416KB

            • memory/2228-442-0x00000000064F0000-0x000000000680C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-18-0x0000000077C60000-0x0000000077C62000-memory.dmp

              Filesize

              8KB

            • memory/2228-485-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-445-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-17-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-497-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-461-0x00000000064F0000-0x00000000067AE000-memory.dmp

              Filesize

              2.7MB

            • memory/2228-460-0x0000000006B10000-0x0000000007196000-memory.dmp

              Filesize

              6.5MB

            • memory/2228-496-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-495-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-489-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-474-0x00000000064F0000-0x000000000680C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-488-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-475-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-487-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-479-0x00000000064F0000-0x00000000067AE000-memory.dmp

              Filesize

              2.7MB

            • memory/2228-262-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-486-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2228-484-0x0000000000230000-0x000000000054C000-memory.dmp

              Filesize

              3.1MB

            • memory/2300-480-0x0000000000220000-0x00000000004DE000-memory.dmp

              Filesize

              2.7MB

            • memory/2300-483-0x0000000000220000-0x00000000004DE000-memory.dmp

              Filesize

              2.7MB

            • memory/2300-465-0x0000000000220000-0x00000000004DE000-memory.dmp

              Filesize

              2.7MB

            • memory/2300-464-0x0000000000220000-0x00000000004DE000-memory.dmp

              Filesize

              2.7MB

            • memory/2300-462-0x0000000000220000-0x00000000004DE000-memory.dmp

              Filesize

              2.7MB

            • memory/2488-404-0x0000000000EF0000-0x0000000001576000-memory.dmp

              Filesize

              6.5MB

            • memory/2488-402-0x0000000000EF0000-0x0000000001576000-memory.dmp

              Filesize

              6.5MB

            • memory/2936-478-0x0000000000080000-0x00000000000D6000-memory.dmp

              Filesize

              344KB

            • memory/2936-476-0x0000000000080000-0x00000000000D6000-memory.dmp

              Filesize

              344KB

            • memory/2936-466-0x0000000000080000-0x00000000000D6000-memory.dmp

              Filesize

              344KB