Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 01:37

General

  • Target

    9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe

  • Size

    2.8MB

  • MD5

    c32d39710b13585f9608ebac9e028ea0

  • SHA1

    96ce25ea1f05d91a7314e6eed4101af60259a811

  • SHA256

    9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a

  • SHA512

    e6222188e39d4260c8de06a4d8033ef2a4c1122e8df22fda616b4bb2de2377846c1621f3cb0d9840c81791b7a1cba3276081063875a91781972a2be0da96e3c5

  • SSDEEP

    49152:GLNDk2Pu0hI2hcbYQc4Nv0PYax7Ia1uTZYs:GFk2PuWIBeOv0P1WayZYs

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

Extracted

Family

lumma

C2

https://shineugler.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 14 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 26 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe
    "C:\Users\Admin\AppData\Local\Temp\9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1984
      • C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"
        3⤵
        • Executes dropped EXE
        PID:572
      • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
        "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
          "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1756
      • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
        "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
          "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1312
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
            5⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2448
      • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
        "C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2024
      • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
        "C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Users\Admin\AppData\Local\Temp\onefile_2476_133788730747986000\stub.exe
          C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2940
      • C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe
        "C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe"
        3⤵
        • Executes dropped EXE
        PID:1436
      • C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe
        "C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\System32\certutil.exe
          "C:\Windows\System32\certutil.exe" -silent -importPFX -p "" -f "C:\Users\Admin\AppData\Local\Temp\tmp517C.tmp"
          4⤵
            PID:3052
        • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
          "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1572
          • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
            "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:1644

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

      Filesize

      307KB

      MD5

      68a99cf42959dc6406af26e91d39f523

      SHA1

      f11db933a83400136dc992820f485e0b73f1b933

      SHA256

      c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

      SHA512

      7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

    • C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe

      Filesize

      809KB

      MD5

      9821fa45714f3b4538cc017320f6f7e5

      SHA1

      5bf0752889cefd64dab0317067d5e593ba32e507

      SHA256

      fd9343a395c034e519aea60471c518edbd8cf1b8a236ec924acf06348e6d3a72

      SHA512

      90afec395115d932ea272b11daa3245769bdcc9421ecd418722830259a64df19ed7eacca38000f6a846db9f4363817f13232032ab30f2ab1aa7e88097361d898

    • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe

      Filesize

      429KB

      MD5

      c07e06e76de584bcddd59073a4161dbb

      SHA1

      08954ac6f6cf51fd5d9d034060a9ae25a8448971

      SHA256

      cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

      SHA512

      e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

    • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe

      Filesize

      429KB

      MD5

      ce27255f0ef33ce6304e54d171e6547c

      SHA1

      e594c6743d869c852bf7a09e7fe8103b25949b6e

      SHA256

      82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

      SHA512

      96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

    • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe

      Filesize

      3.6MB

      MD5

      378706614b22957208e09fc84fceece8

      SHA1

      d35e1f89f36aed26553b665f791cd69d82136fb8

      SHA256

      df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d

      SHA512

      bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e

    • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe

      Filesize

      10.7MB

      MD5

      6898eace70e2da82f257bc78cb081b2f

      SHA1

      5ac5ed21436d8b4c59c0b62836d531844c571d6d

      SHA256

      bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23

      SHA512

      ca719707417a095fe092837e870aefc7e8874ef351e27b5b41e40f46a9e2f6cb2ba915858bc3c99a14c2f1288c71c7ddd9c2adee6588d6b43cd3ba276e1585d2

    • C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe

      Filesize

      396KB

      MD5

      876bf2dec67ea8626322d2c268219d76

      SHA1

      ecb0c0cd486733491804a05cf387f2d04d5e2279

      SHA256

      08d37bbc1881f5fbfdcc84e3270320bb4d03a3ad4fcdf1d996c9de0ca8f2b425

      SHA512

      9268392683a9962143f987f069d97016abd1ccd61bb67aa8e3f8d9c4b7aa6168d3c01884ce9023831216b8710eddee2d52fcb3c84dbacefe94cb28fa661b6a79

    • C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe

      Filesize

      4.5MB

      MD5

      38fcaa23700e62fb0b3fc2591f82cc80

      SHA1

      abedd6ec573a6fede05d15920f3ac3763062c75c

      SHA256

      fb829a6a8535a443932cd167e8301b5e74c60702b5f7fade7e9f13a736ce72b0

      SHA512

      5da88a61c716a9891cb225f36f275040d69915c4c731c2a5c042d5c997ca39241a3e9d6646569468d477f47db42462c21b58f2de7f56a84cb145e6cee478eeef

    • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe

      Filesize

      2.5MB

      MD5

      7ff947867bc70055adffa2164a741b01

      SHA1

      cff424168c2f6bcef107ebc9bd65590f3ead76ae

      SHA256

      b6d6628d2dc7dea808eef05180c27abe10a1af245d624aacdacccc52a1eb7b40

      SHA512

      da507d1847056d0dc2c122c45ecbea4901a81c06890bcdbffc2f18ad4b96f0ac2c2fa9ebde1a315828c74a97af653062a8c50ce70c9b6d6966c48871150747ee

    • C:\Users\Admin\AppData\Local\Temp\Cab4AA9.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar4ACB.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\Tmp50CF.tmp

      Filesize

      2KB

      MD5

      8da766ea04e5e71e5c8b3b71a4055427

      SHA1

      9128bcf502e397fcfce37896b076fb645c372c18

      SHA256

      3dfac49d50b7ac19b18ac8731c7fb74917b75ace1883bae3bb381e6e53cc2a3e

      SHA512

      de37be111fab6dc69eba4de9562bf611a3877be39db628b3abc5ff1f09858516e6c7680dd2f21d082ac8f595d7f6268dfa9bc2dbab5177a533fc2695c59cb639

    • C:\Users\Admin\AppData\Local\Temp\onefile_2476_133788730747986000\stub.exe

      Filesize

      16.1MB

      MD5

      d09a400f60c7a298e884f90539e9c72f

      SHA1

      41582ba130bef907e24f87534e7a0fdd37025101

      SHA256

      700962aa295e2fa207ff522e2f5ca051a2929eb6f252d42c9cb0a56a4f084bfe

      SHA512

      d8ba2859bb2ea109c1ca33cb924e40bf61db79aefb59324101d9f47a08835d86834790d3bc6bad4151a561ef82265b32d5111bc80f95dce769c5eb4da5116cc9

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\B42B8238019DD9F1AC08238D658A7D740CD281EA

      Filesize

      1KB

      MD5

      bd2f93e7a5c796106949fa6a5d4e331d

      SHA1

      4808420c5a3f3bd0413d69f446f887093f1bdccd

      SHA256

      b867b020cccd57721dbf21805640cf0e72d6f115ed9e88738247ffcfc1c7ce8f

      SHA512

      50dd165f1684c1768043df0f75e09b0554b24da91e838d04eab85aa8f380654f414f35591ebb6c659421a1df921fab372c00c9ad85091a9a109ae587f334c25b

    • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

      Filesize

      124KB

      MD5

      0d3418372c854ee228b78e16ea7059be

      SHA1

      c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

      SHA256

      885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

      SHA512

      e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

    • \ProgramData\mozglue.dll

      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    • \ProgramData\nss3.dll

      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

      Filesize

      2.8MB

      MD5

      c32d39710b13585f9608ebac9e028ea0

      SHA1

      96ce25ea1f05d91a7314e6eed4101af60259a811

      SHA256

      9ec7fc750fe77210f8b47d16680bdcf7c2c97177517e604214eb560a2a90386a

      SHA512

      e6222188e39d4260c8de06a4d8033ef2a4c1122e8df22fda616b4bb2de2377846c1621f3cb0d9840c81791b7a1cba3276081063875a91781972a2be0da96e3c5

    • \Users\Admin\AppData\Local\Temp\onefile_2476_133788730747986000\python310.dll

      Filesize

      4.3MB

      MD5

      c80b5cb43e5fe7948c3562c1fff1254e

      SHA1

      f73cb1fb9445c96ecd56b984a1822e502e71ab9d

      SHA256

      058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

      SHA512

      faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

    • memory/1624-18-0x0000000001160000-0x000000000146D000-memory.dmp

      Filesize

      3.1MB

    • memory/1624-5-0x0000000001160000-0x000000000146D000-memory.dmp

      Filesize

      3.1MB

    • memory/1624-3-0x0000000001160000-0x000000000146D000-memory.dmp

      Filesize

      3.1MB

    • memory/1624-19-0x0000000006940000-0x0000000006C4D000-memory.dmp

      Filesize

      3.1MB

    • memory/1624-2-0x0000000001161000-0x000000000118F000-memory.dmp

      Filesize

      184KB

    • memory/1624-0-0x0000000001160000-0x000000000146D000-memory.dmp

      Filesize

      3.1MB

    • memory/1624-1-0x0000000077430000-0x0000000077432000-memory.dmp

      Filesize

      8KB

    • memory/1644-411-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/1644-413-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/1644-410-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/1644-418-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/1644-408-0x00000000000B0000-0x0000000000106000-memory.dmp

      Filesize

      344KB

    • memory/1984-187-0x0000000000E90000-0x00000000010F1000-memory.dmp

      Filesize

      2.4MB

    • memory/1984-43-0x0000000000E90000-0x00000000010F1000-memory.dmp

      Filesize

      2.4MB

    • memory/1984-111-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

    • memory/2024-163-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2024-162-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2024-191-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2024-161-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2024-159-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2024-329-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2024-160-0x0000000000400000-0x0000000000C4D000-memory.dmp

      Filesize

      8.3MB

    • memory/2124-292-0x0000000001040000-0x00000000014D0000-memory.dmp

      Filesize

      4.6MB

    • memory/2476-405-0x000000013F400000-0x000000013FED2000-memory.dmp

      Filesize

      10.8MB

    • memory/2760-331-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-416-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-430-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-44-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-40-0x0000000006160000-0x00000000063C1000-memory.dmp

      Filesize

      2.4MB

    • memory/2760-61-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-85-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-24-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-22-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-21-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-100-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-189-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-20-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-188-0x0000000006780000-0x0000000006FCD000-memory.dmp

      Filesize

      8.3MB

    • memory/2760-141-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-42-0x0000000006160000-0x00000000063C1000-memory.dmp

      Filesize

      2.4MB

    • memory/2760-158-0x0000000006780000-0x0000000006FCD000-memory.dmp

      Filesize

      8.3MB

    • memory/2760-419-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-420-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-421-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-422-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-423-0x0000000006160000-0x00000000063C1000-memory.dmp

      Filesize

      2.4MB

    • memory/2760-424-0x0000000006160000-0x00000000063C1000-memory.dmp

      Filesize

      2.4MB

    • memory/2760-425-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-426-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-427-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-428-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2760-429-0x0000000000F80000-0x000000000128D000-memory.dmp

      Filesize

      3.1MB

    • memory/2940-271-0x000000013F550000-0x00000001405B9000-memory.dmp

      Filesize

      16.4MB