Analysis

  • max time kernel
    300s
  • max time network
    274s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/01/2023, 04:05

General

  • Target

    619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab.exe

  • Size

    244KB

  • MD5

    43a3e1c9723e124a9b495cd474a05dcb

  • SHA1

    d293f427eaa8efc18bb8929a9f54fb61e03bdd89

  • SHA256

    619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

  • SHA512

    6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

  • SSDEEP

    6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 22 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1316
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2680
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2660
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k WspService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3080
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2396
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2356
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1912
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1404
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1176
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1096
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:424
    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      2⤵
      • Executes dropped EXE
      PID:4772
    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      2⤵
      • Executes dropped EXE
      PID:2324
    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      2⤵
      • Executes dropped EXE
      PID:2672
    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      2⤵
      • Executes dropped EXE
      PID:4848
    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      2⤵
      • Executes dropped EXE
      PID:972
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:348
  • C:\Users\Admin\AppData\Local\Temp\619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab.exe
    "C:\Users\Admin\AppData\Local\Temp\619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:3600
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "nbveek.exe" /P "Admin:N"
            4⤵
              PID:5088
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "nbveek.exe" /P "Admin:R" /E
              4⤵
                PID:4272
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:4008
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\16de06bfb4" /P "Admin:N"
                  4⤵
                    PID:3248
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\16de06bfb4" /P "Admin:R" /E
                    4⤵
                      PID:4948
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
                    3⤵
                    • Creates scheduled task(s)
                    PID:3088
                  • C:\Users\Admin\AppData\Local\Temp\1000001001\pb1111.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000001001\pb1111.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:4300
                  • C:\Users\Admin\AppData\Local\Temp\1000002001\wj.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000002001\wj.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4804
                    • C:\Users\Admin\AppData\Local\Temp\1000002001\wj.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000002001\wj.exe" -h
                      4⤵
                      • Executes dropped EXE
                      PID:3204
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:5056
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:1820
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 1820 -s 648
                        5⤵
                        • Program crash
                        PID:4992
              • C:\Windows\system32\rundll32.exe
                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                1⤵
                • Process spawned unexpected child process
                • Suspicious use of WriteProcessMemory
                PID:2624
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                  2⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3964

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\1000001001\pb1111.exe

                      Filesize

                      3.5MB

                      MD5

                      682fdceb8132982fe1bc167d349a2e0d

                      SHA1

                      31ceaf4fba8e3724282657ff55fc90c95b49df1b

                      SHA256

                      6648c16ea58b3cbb22617541fe2ac5c88291e5d540e6100e7ed4d53eb4f58e2b

                      SHA512

                      8dadb472c47065d7e0aaf6c129397d814b0d8408a9c0dc5f0ce32d26539f40accb182c17fcac343ab943d6a6393c70c4e10aa3f7ab0e14e463292468a4adc3d1

                    • C:\Users\Admin\AppData\Local\Temp\1000001001\pb1111.exe

                      Filesize

                      3.5MB

                      MD5

                      682fdceb8132982fe1bc167d349a2e0d

                      SHA1

                      31ceaf4fba8e3724282657ff55fc90c95b49df1b

                      SHA256

                      6648c16ea58b3cbb22617541fe2ac5c88291e5d540e6100e7ed4d53eb4f58e2b

                      SHA512

                      8dadb472c47065d7e0aaf6c129397d814b0d8408a9c0dc5f0ce32d26539f40accb182c17fcac343ab943d6a6393c70c4e10aa3f7ab0e14e463292468a4adc3d1

                    • C:\Users\Admin\AppData\Local\Temp\1000002001\wj.exe

                      Filesize

                      131KB

                      MD5

                      c139e5739b99c5a835aaf6642b7a4378

                      SHA1

                      4ef2c73cd79984bd634adddbeef4dd091394ff46

                      SHA256

                      c82ab145610c19c3f5a1462196b41347c9786f5e600bdaa477bb98814461d279

                      SHA512

                      2fdfcc9534a8045976a795373557ad60548c36ea3c54e334e4a337100e3a879f802989b2dcac6565688f466d5fbde8e4e1e5e7d1b54151aacd2408329140f799

                    • C:\Users\Admin\AppData\Local\Temp\1000002001\wj.exe

                      Filesize

                      131KB

                      MD5

                      c139e5739b99c5a835aaf6642b7a4378

                      SHA1

                      4ef2c73cd79984bd634adddbeef4dd091394ff46

                      SHA256

                      c82ab145610c19c3f5a1462196b41347c9786f5e600bdaa477bb98814461d279

                      SHA512

                      2fdfcc9534a8045976a795373557ad60548c36ea3c54e334e4a337100e3a879f802989b2dcac6565688f466d5fbde8e4e1e5e7d1b54151aacd2408329140f799

                    • C:\Users\Admin\AppData\Local\Temp\1000002001\wj.exe

                      Filesize

                      131KB

                      MD5

                      c139e5739b99c5a835aaf6642b7a4378

                      SHA1

                      4ef2c73cd79984bd634adddbeef4dd091394ff46

                      SHA256

                      c82ab145610c19c3f5a1462196b41347c9786f5e600bdaa477bb98814461d279

                      SHA512

                      2fdfcc9534a8045976a795373557ad60548c36ea3c54e334e4a337100e3a879f802989b2dcac6565688f466d5fbde8e4e1e5e7d1b54151aacd2408329140f799

                    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                      Filesize

                      244KB

                      MD5

                      43a3e1c9723e124a9b495cd474a05dcb

                      SHA1

                      d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                      SHA256

                      619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                      SHA512

                      6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                      Filesize

                      244KB

                      MD5

                      43a3e1c9723e124a9b495cd474a05dcb

                      SHA1

                      d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                      SHA256

                      619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                      SHA512

                      6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                      Filesize

                      244KB

                      MD5

                      43a3e1c9723e124a9b495cd474a05dcb

                      SHA1

                      d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                      SHA256

                      619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                      SHA512

                      6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                      Filesize

                      244KB

                      MD5

                      43a3e1c9723e124a9b495cd474a05dcb

                      SHA1

                      d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                      SHA256

                      619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                      SHA512

                      6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                      Filesize

                      244KB

                      MD5

                      43a3e1c9723e124a9b495cd474a05dcb

                      SHA1

                      d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                      SHA256

                      619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                      SHA512

                      6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                      Filesize

                      244KB

                      MD5

                      43a3e1c9723e124a9b495cd474a05dcb

                      SHA1

                      d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                      SHA256

                      619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                      SHA512

                      6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                    • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                      Filesize

                      244KB

                      MD5

                      43a3e1c9723e124a9b495cd474a05dcb

                      SHA1

                      d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                      SHA256

                      619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                      SHA512

                      6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                    • C:\Users\Admin\AppData\Local\Temp\db.dat

                      Filesize

                      557KB

                      MD5

                      30d5f615722d12fdda4f378048221909

                      SHA1

                      e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

                      SHA256

                      b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

                      SHA512

                      a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

                    • C:\Users\Admin\AppData\Local\Temp\db.dll

                      Filesize

                      52KB

                      MD5

                      0b35335b70b96d31633d0caa207d71f9

                      SHA1

                      996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                      SHA256

                      ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                      SHA512

                      ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                    • C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

                      Filesize

                      1.0MB

                      MD5

                      2c4e958144bd089aa93a564721ed28bb

                      SHA1

                      38ef85f66b7fdc293661e91ba69f31598c5b5919

                      SHA256

                      b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

                      SHA512

                      a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

                    • \Users\Admin\AppData\Local\Temp\db.dll

                      Filesize

                      52KB

                      MD5

                      0b35335b70b96d31633d0caa207d71f9

                      SHA1

                      996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                      SHA256

                      ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                      SHA512

                      ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                    • \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

                      Filesize

                      1.0MB

                      MD5

                      2c4e958144bd089aa93a564721ed28bb

                      SHA1

                      38ef85f66b7fdc293661e91ba69f31598c5b5919

                      SHA256

                      b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

                      SHA512

                      a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

                    • \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

                      Filesize

                      1.0MB

                      MD5

                      2c4e958144bd089aa93a564721ed28bb

                      SHA1

                      38ef85f66b7fdc293661e91ba69f31598c5b5919

                      SHA256

                      b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

                      SHA512

                      a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

                    • memory/348-532-0x0000018914140000-0x00000189141B2000-memory.dmp

                      Filesize

                      456KB

                    • memory/424-537-0x0000027D5F070000-0x0000027D5F0E2000-memory.dmp

                      Filesize

                      456KB

                    • memory/1096-536-0x0000016FCF840000-0x0000016FCF8B2000-memory.dmp

                      Filesize

                      456KB

                    • memory/1176-540-0x000001B194F40000-0x000001B194FB2000-memory.dmp

                      Filesize

                      456KB

                    • memory/1316-541-0x0000028344670000-0x00000283446E2000-memory.dmp

                      Filesize

                      456KB

                    • memory/1404-538-0x000001D224E00000-0x000001D224E72000-memory.dmp

                      Filesize

                      456KB

                    • memory/1912-539-0x0000028C16040000-0x0000028C160B2000-memory.dmp

                      Filesize

                      456KB

                    • memory/2016-182-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-179-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-171-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-185-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-170-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-180-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-184-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-183-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-167-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-181-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-174-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-186-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-178-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-177-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-176-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-175-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-173-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-169-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-166-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2016-168-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-151-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-126-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-162-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-161-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-160-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-159-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-158-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-157-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-156-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-155-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-154-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-153-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-152-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-120-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-150-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-149-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-148-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-147-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-146-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-121-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-122-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-123-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-124-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-130-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-125-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-133-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-131-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-128-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-145-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-144-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-127-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-143-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-142-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-129-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-141-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-140-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-132-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-138-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-139-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-163-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-134-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-135-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-136-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2108-137-0x00000000779E0000-0x0000000077B6E000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/2356-534-0x000001C4D3640000-0x000001C4D36B2000-memory.dmp

                      Filesize

                      456KB

                    • memory/2396-535-0x000001A092AD0000-0x000001A092B42000-memory.dmp

                      Filesize

                      456KB

                    • memory/2588-531-0x0000021EDE110000-0x0000021EDE182000-memory.dmp

                      Filesize

                      456KB

                    • memory/2588-530-0x0000021EDE010000-0x0000021EDE05D000-memory.dmp

                      Filesize

                      308KB

                    • memory/2660-542-0x000001A8AA430000-0x000001A8AA4A2000-memory.dmp

                      Filesize

                      456KB

                    • memory/2680-543-0x00000210B4F60000-0x00000210B4FD2000-memory.dmp

                      Filesize

                      456KB

                    • memory/3080-551-0x0000021C12A10000-0x0000021C12A91000-memory.dmp

                      Filesize

                      516KB

                    • memory/3080-544-0x0000021C111D0000-0x0000021C11242000-memory.dmp

                      Filesize

                      456KB

                    • memory/3080-549-0x0000021C12A10000-0x0000021C12A91000-memory.dmp

                      Filesize

                      516KB

                    • memory/3080-550-0x0000021C13700000-0x0000021C13804000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/3080-552-0x0000021C12A10000-0x0000021C12A91000-memory.dmp

                      Filesize

                      516KB

                    • memory/3080-553-0x0000021C12A10000-0x0000021C12A91000-memory.dmp

                      Filesize

                      516KB

                    • memory/3080-554-0x0000021C13700000-0x0000021C13804000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/3080-555-0x0000021C12A10000-0x0000021C12A91000-memory.dmp

                      Filesize

                      516KB

                    • memory/3080-556-0x0000021C12A10000-0x0000021C12A91000-memory.dmp

                      Filesize

                      516KB

                    • memory/3080-533-0x0000021C111D0000-0x0000021C11242000-memory.dmp

                      Filesize

                      456KB

                    • memory/3964-529-0x0000000000A40000-0x0000000000A9E000-memory.dmp

                      Filesize

                      376KB