Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2022, 01:55

General

  • Target

    431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411.exe

  • Size

    300KB

  • MD5

    b6b503be7216e3fc3c685b8b222f60e5

  • SHA1

    b12fe336e09bf6a8173400ecb7c1108cf96f72fc

  • SHA256

    431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411

  • SHA512

    108d5861a1e53f96a92816e1ea587896b89626b338ea142e59884e8ed639eaf6dc794fd3e0e7496c1fb61b993191c430090a62a96560a16f78e672fc4b2a6925

  • SSDEEP

    6144:2LRUK/nt7ky+yE/xYtIznPtwTGYNciDtmmUXT:2FUK/ntr+y2tPOGiciDtmtT

Malware Config

Extracted

Family

amadey

Version

3.63

C2

62.204.41.17/8bdSvcD/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 27 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411.exe
    "C:\Users\Admin\AppData\Local\Temp\431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 928
      2⤵
      • Program crash
      PID:844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 936
      2⤵
      • Program crash
      PID:5020
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 936
      2⤵
      • Program crash
      PID:696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1060
      2⤵
      • Program crash
      PID:4156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1108
      2⤵
      • Program crash
      PID:4472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1056
      2⤵
      • Program crash
      PID:2604
    • C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 520
        3⤵
        • Program crash
        PID:3644
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 764
        3⤵
        • Program crash
        PID:1592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 824
        3⤵
        • Program crash
        PID:1672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 808
        3⤵
        • Program crash
        PID:2912
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 972
        3⤵
        • Program crash
        PID:432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 848
        3⤵
        • Program crash
        PID:1492
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 984
        3⤵
        • Program crash
        PID:3476
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:2192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 916
        3⤵
        • Program crash
        PID:4264
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 668
        3⤵
        • Program crash
        PID:2392
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 620
        3⤵
        • Program crash
        PID:4128
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 916
        3⤵
        • Program crash
        PID:4736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1320
        3⤵
        • Program crash
        PID:4688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1264
        3⤵
        • Program crash
        PID:2508
      • C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe
        "C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Windows\SysWOW64\control.exe
          "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\je6YfEPZ.CPL",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\je6YfEPZ.CPL",
            5⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1616
            • C:\Windows\system32\RunDll32.exe
              C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\je6YfEPZ.CPL",
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1340
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\je6YfEPZ.CPL",
                7⤵
                • Loads dropped DLL
                PID:2220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1612
        3⤵
        • Program crash
        PID:2876
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 972
        3⤵
        • Program crash
        PID:4472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1680
        3⤵
        • Program crash
        PID:796
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:2340
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 848
        3⤵
        • Program crash
        PID:1156
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1696
        3⤵
        • Program crash
        PID:3924
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 896
      2⤵
      • Program crash
      PID:4952
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4888 -ip 4888
    1⤵
      PID:4744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4888 -ip 4888
      1⤵
        PID:5008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4888 -ip 4888
        1⤵
          PID:2564
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4888 -ip 4888
          1⤵
            PID:1280
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4888 -ip 4888
            1⤵
              PID:4388
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4888 -ip 4888
              1⤵
                PID:2796
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4888 -ip 4888
                1⤵
                  PID:2356
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4452 -ip 4452
                  1⤵
                    PID:3140
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4452 -ip 4452
                    1⤵
                      PID:4408
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4452 -ip 4452
                      1⤵
                        PID:2544
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4452 -ip 4452
                        1⤵
                          PID:384
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4452 -ip 4452
                          1⤵
                            PID:420
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4452 -ip 4452
                            1⤵
                              PID:4232
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4452 -ip 4452
                              1⤵
                                PID:4404
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4452 -ip 4452
                                1⤵
                                  PID:3304
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4452 -ip 4452
                                  1⤵
                                    PID:1796
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4452 -ip 4452
                                    1⤵
                                      PID:4180
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4452 -ip 4452
                                      1⤵
                                        PID:4392
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4452 -ip 4452
                                        1⤵
                                          PID:4628
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4452 -ip 4452
                                          1⤵
                                            PID:5072
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4452 -ip 4452
                                            1⤵
                                              PID:4812
                                            • C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
                                              C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:696
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 312
                                                2⤵
                                                • Program crash
                                                PID:1500
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 696 -ip 696
                                              1⤵
                                                PID:4824
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4452 -ip 4452
                                                1⤵
                                                  PID:3528
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4452 -ip 4452
                                                  1⤵
                                                    PID:3568
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4452 -ip 4452
                                                    1⤵
                                                      PID:3360
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4452 -ip 4452
                                                      1⤵
                                                        PID:3508
                                                      • C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
                                                        C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:3392
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 320
                                                          2⤵
                                                          • Program crash
                                                          PID:3728
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3392 -ip 3392
                                                        1⤵
                                                          PID:2260

                                                        Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe

                                                          Filesize

                                                          1.7MB

                                                          MD5

                                                          e1f2ce87e294a3d99c531a5d96719cf3

                                                          SHA1

                                                          790f64d1b1ca40924c06aa5428c953eb410ee8c0

                                                          SHA256

                                                          b095fc1a12f0056f5cb0e3a31121c0e7a1941217763ff473f9cb5fd46d1d2eed

                                                          SHA512

                                                          608ae3e77fe00208495d2b0621615f05c5ede1fc889178cdd007bed3d1097efc5e93e66377c9f1dc82c903dcafa49791ae98786e22e69617bbc5277cbe0264b7

                                                        • C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe

                                                          Filesize

                                                          1.7MB

                                                          MD5

                                                          e1f2ce87e294a3d99c531a5d96719cf3

                                                          SHA1

                                                          790f64d1b1ca40924c06aa5428c953eb410ee8c0

                                                          SHA256

                                                          b095fc1a12f0056f5cb0e3a31121c0e7a1941217763ff473f9cb5fd46d1d2eed

                                                          SHA512

                                                          608ae3e77fe00208495d2b0621615f05c5ede1fc889178cdd007bed3d1097efc5e93e66377c9f1dc82c903dcafa49791ae98786e22e69617bbc5277cbe0264b7

                                                        • C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe

                                                          Filesize

                                                          300KB

                                                          MD5

                                                          b6b503be7216e3fc3c685b8b222f60e5

                                                          SHA1

                                                          b12fe336e09bf6a8173400ecb7c1108cf96f72fc

                                                          SHA256

                                                          431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411

                                                          SHA512

                                                          108d5861a1e53f96a92816e1ea587896b89626b338ea142e59884e8ed639eaf6dc794fd3e0e7496c1fb61b993191c430090a62a96560a16f78e672fc4b2a6925

                                                        • C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe

                                                          Filesize

                                                          300KB

                                                          MD5

                                                          b6b503be7216e3fc3c685b8b222f60e5

                                                          SHA1

                                                          b12fe336e09bf6a8173400ecb7c1108cf96f72fc

                                                          SHA256

                                                          431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411

                                                          SHA512

                                                          108d5861a1e53f96a92816e1ea587896b89626b338ea142e59884e8ed639eaf6dc794fd3e0e7496c1fb61b993191c430090a62a96560a16f78e672fc4b2a6925

                                                        • C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe

                                                          Filesize

                                                          300KB

                                                          MD5

                                                          b6b503be7216e3fc3c685b8b222f60e5

                                                          SHA1

                                                          b12fe336e09bf6a8173400ecb7c1108cf96f72fc

                                                          SHA256

                                                          431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411

                                                          SHA512

                                                          108d5861a1e53f96a92816e1ea587896b89626b338ea142e59884e8ed639eaf6dc794fd3e0e7496c1fb61b993191c430090a62a96560a16f78e672fc4b2a6925

                                                        • C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe

                                                          Filesize

                                                          300KB

                                                          MD5

                                                          b6b503be7216e3fc3c685b8b222f60e5

                                                          SHA1

                                                          b12fe336e09bf6a8173400ecb7c1108cf96f72fc

                                                          SHA256

                                                          431fab789f65114a9a625770d72850191832de05b4f6368ffb2cf877a02b9411

                                                          SHA512

                                                          108d5861a1e53f96a92816e1ea587896b89626b338ea142e59884e8ed639eaf6dc794fd3e0e7496c1fb61b993191c430090a62a96560a16f78e672fc4b2a6925

                                                        • C:\Users\Admin\AppData\Local\Temp\je6YfEPZ.CPL

                                                          Filesize

                                                          1.5MB

                                                          MD5

                                                          bd90347b2eefdb672af9e92289e549bd

                                                          SHA1

                                                          368cc9ce2f6f267d2cb7f3270c86ad4b583e02a5

                                                          SHA256

                                                          9b4ef0ec755471f072df0e5c01db521e60ad886ecabb178d0867bf6be91aa893

                                                          SHA512

                                                          1e709e4d5c9b19fcc3117ab71fddcc73c49880f8ae12dd13234aaaefca68e6003330f10b393b09489b3265ca72f65ac58aae610812e49dc6db4254d6cb2baffa

                                                        • C:\Users\Admin\AppData\Local\Temp\je6yfEPZ.cpl

                                                          Filesize

                                                          1.5MB

                                                          MD5

                                                          bd90347b2eefdb672af9e92289e549bd

                                                          SHA1

                                                          368cc9ce2f6f267d2cb7f3270c86ad4b583e02a5

                                                          SHA256

                                                          9b4ef0ec755471f072df0e5c01db521e60ad886ecabb178d0867bf6be91aa893

                                                          SHA512

                                                          1e709e4d5c9b19fcc3117ab71fddcc73c49880f8ae12dd13234aaaefca68e6003330f10b393b09489b3265ca72f65ac58aae610812e49dc6db4254d6cb2baffa

                                                        • C:\Users\Admin\AppData\Local\Temp\je6yfEPZ.cpl

                                                          Filesize

                                                          1.5MB

                                                          MD5

                                                          bd90347b2eefdb672af9e92289e549bd

                                                          SHA1

                                                          368cc9ce2f6f267d2cb7f3270c86ad4b583e02a5

                                                          SHA256

                                                          9b4ef0ec755471f072df0e5c01db521e60ad886ecabb178d0867bf6be91aa893

                                                          SHA512

                                                          1e709e4d5c9b19fcc3117ab71fddcc73c49880f8ae12dd13234aaaefca68e6003330f10b393b09489b3265ca72f65ac58aae610812e49dc6db4254d6cb2baffa

                                                        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                                                          Filesize

                                                          126KB

                                                          MD5

                                                          9cb722f11d688872348be236f8e5d149

                                                          SHA1

                                                          e54f80b631c1931b574baf6953a3948fe3d7d354

                                                          SHA256

                                                          53bb660c1ae533d41b887a771ab2d8a2f73320c4d1441448c4bf75dfbc875321

                                                          SHA512

                                                          52e318939fd63c89ee8f92b3c7e17f08919f6a5ac229418a6f0678daad9a3f285f121ad4aab7ef4bb575d368c989fc02e07a654b919f9bb1ba7fe7a9c5c37774

                                                        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                                                          Filesize

                                                          126KB

                                                          MD5

                                                          9cb722f11d688872348be236f8e5d149

                                                          SHA1

                                                          e54f80b631c1931b574baf6953a3948fe3d7d354

                                                          SHA256

                                                          53bb660c1ae533d41b887a771ab2d8a2f73320c4d1441448c4bf75dfbc875321

                                                          SHA512

                                                          52e318939fd63c89ee8f92b3c7e17f08919f6a5ac229418a6f0678daad9a3f285f121ad4aab7ef4bb575d368c989fc02e07a654b919f9bb1ba7fe7a9c5c37774

                                                        • memory/696-164-0x0000000000400000-0x000000000046F000-memory.dmp

                                                          Filesize

                                                          444KB

                                                        • memory/696-163-0x000000000084C000-0x000000000086A000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/1616-150-0x0000000002D60000-0x0000000002EE4000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/1616-155-0x0000000003430000-0x00000000034FE000-memory.dmp

                                                          Filesize

                                                          824KB

                                                        • memory/1616-154-0x0000000002BC0000-0x0000000002CA6000-memory.dmp

                                                          Filesize

                                                          920KB

                                                        • memory/1616-151-0x0000000072690000-0x000000007281C000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/2220-165-0x0000000003300000-0x0000000003484000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/2220-167-0x00000000039D0000-0x0000000003A9E000-memory.dmp

                                                          Filesize

                                                          824KB

                                                        • memory/2220-166-0x0000000003150000-0x0000000003236000-memory.dmp

                                                          Filesize

                                                          920KB

                                                        • memory/2220-162-0x0000000003300000-0x0000000003484000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/3392-175-0x0000000000400000-0x000000000046F000-memory.dmp

                                                          Filesize

                                                          444KB

                                                        • memory/3392-174-0x00000000005FC000-0x000000000061A000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/4452-140-0x0000000000648000-0x0000000000667000-memory.dmp

                                                          Filesize

                                                          124KB

                                                        • memory/4452-141-0x0000000000400000-0x000000000046F000-memory.dmp

                                                          Filesize

                                                          444KB

                                                        • memory/4452-153-0x0000000000400000-0x000000000046F000-memory.dmp

                                                          Filesize

                                                          444KB

                                                        • memory/4452-152-0x0000000000648000-0x0000000000667000-memory.dmp

                                                          Filesize

                                                          124KB

                                                        • memory/4888-138-0x00000000004F8000-0x0000000000517000-memory.dmp

                                                          Filesize

                                                          124KB

                                                        • memory/4888-139-0x0000000000400000-0x000000000046F000-memory.dmp

                                                          Filesize

                                                          444KB

                                                        • memory/4888-132-0x00000000004F8000-0x0000000000517000-memory.dmp

                                                          Filesize

                                                          124KB

                                                        • memory/4888-134-0x0000000000400000-0x000000000046F000-memory.dmp

                                                          Filesize

                                                          444KB

                                                        • memory/4888-133-0x00000000021D0000-0x000000000220C000-memory.dmp

                                                          Filesize

                                                          240KB