Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2023, 05:22

General

  • Target

    850365dd6bb63649f52baf4d1385cc3459717cf6cfc0601f73552779d8d05940.exe

  • Size

    1.2MB

  • MD5

    0969c5c12a38a4578efe9070c9d6a60a

  • SHA1

    3a50df8305cf41c63193154bb8005db3f085e3ef

  • SHA256

    850365dd6bb63649f52baf4d1385cc3459717cf6cfc0601f73552779d8d05940

  • SHA512

    4c5139f2f8b728e86ac5c50a5d245fb26060ea7bc000fff8e15ce033b656d85a221e202ba118376fc609685654fb40f5e9598ae9c83be8883175814d56d7b554

  • SSDEEP

    24576:1yLrsee5ue7P4g2hvwOMghjtAh53up+x44pQh3:QNeZz4g4vw8cep6V2h

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\850365dd6bb63649f52baf4d1385cc3459717cf6cfc0601f73552779d8d05940.exe
    "C:\Users\Admin\AppData\Local\Temp\850365dd6bb63649f52baf4d1385cc3459717cf6cfc0601f73552779d8d05940.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za631709.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za631709.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za981319.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za981319.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4396
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za123298.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za123298.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6891.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6891.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1212
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2904Rm.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2904Rm.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:988
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1728
              6⤵
              • Program crash
              PID:544
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74zb63.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74zb63.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:756
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1088
            5⤵
            • Program crash
            PID:5112
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYgKv69.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYgKv69.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2292
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 1324
          4⤵
          • Program crash
          PID:4920
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66HQ65.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66HQ65.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:452
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          4⤵
          • Loads dropped DLL
          PID:4528
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 988 -ip 988
    1⤵
      PID:4280
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 756 -ip 756
      1⤵
        PID:1264
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2292 -ip 2292
        1⤵
          PID:4588
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          1⤵
          • Executes dropped EXE
          PID:2696

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66HQ65.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66HQ65.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za631709.exe

          Filesize

          1.0MB

          MD5

          c89319bd6d2efce19b7c4a9f10dad42e

          SHA1

          80916a6ae621a54cfaf490412cc10e66c836fa55

          SHA256

          f28f5e22063b7b10bf19b84e083878841be73023ccb9580351abc18999c8fe1f

          SHA512

          284501e7fd8f6a804085230ba7096046cdb22f99dfddd03d31bc462fd47e825be7adaa62c0b68f63d3cebe895ac5ace48741de144f19a52f3103cdbb799eb74d

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za631709.exe

          Filesize

          1.0MB

          MD5

          c89319bd6d2efce19b7c4a9f10dad42e

          SHA1

          80916a6ae621a54cfaf490412cc10e66c836fa55

          SHA256

          f28f5e22063b7b10bf19b84e083878841be73023ccb9580351abc18999c8fe1f

          SHA512

          284501e7fd8f6a804085230ba7096046cdb22f99dfddd03d31bc462fd47e825be7adaa62c0b68f63d3cebe895ac5ace48741de144f19a52f3103cdbb799eb74d

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYgKv69.exe

          Filesize

          486KB

          MD5

          8aac4d075be1fd366690f42b5d18d556

          SHA1

          12070409400c5d5ba6b20964a4597e20939fe93f

          SHA256

          8a0b1a9872ff06c9cb0cf2e6f10807c585381f253bed4044719e6da4fc85ab44

          SHA512

          8621eceed26856b861bc139198538f2921755d3238580c755694c452157cf063c0491ef7dcea1569ae43922643de41b638ed28a9ebe0e2baac231089cd964e0f

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYgKv69.exe

          Filesize

          486KB

          MD5

          8aac4d075be1fd366690f42b5d18d556

          SHA1

          12070409400c5d5ba6b20964a4597e20939fe93f

          SHA256

          8a0b1a9872ff06c9cb0cf2e6f10807c585381f253bed4044719e6da4fc85ab44

          SHA512

          8621eceed26856b861bc139198538f2921755d3238580c755694c452157cf063c0491ef7dcea1569ae43922643de41b638ed28a9ebe0e2baac231089cd964e0f

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za981319.exe

          Filesize

          751KB

          MD5

          de5aa7b2d65f99f41a1a1d83aa1a3c70

          SHA1

          98c1aaae990f8e9105b67efbdb921cbfb4b6c77b

          SHA256

          989926866ce8714ceff34ba8f034d8227a2f105a4f928ab607bb6d26abd9331b

          SHA512

          624953a2447d26d82a8631f0219532e6d156b945d8a284eebe427a1bbf3fe0f56fe369db5b89e59cacac2523dbc03a1bcc9f6efad2cb07e889fe2b40868ef350

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za981319.exe

          Filesize

          751KB

          MD5

          de5aa7b2d65f99f41a1a1d83aa1a3c70

          SHA1

          98c1aaae990f8e9105b67efbdb921cbfb4b6c77b

          SHA256

          989926866ce8714ceff34ba8f034d8227a2f105a4f928ab607bb6d26abd9331b

          SHA512

          624953a2447d26d82a8631f0219532e6d156b945d8a284eebe427a1bbf3fe0f56fe369db5b89e59cacac2523dbc03a1bcc9f6efad2cb07e889fe2b40868ef350

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74zb63.exe

          Filesize

          277KB

          MD5

          975cfdea90bac1e372d46a05e0afcf2e

          SHA1

          98edde6d0055c418d2ee7b0dc9d0ee65521ae847

          SHA256

          864d50ecc0bed6118d9c8cb21630dbad4535b3078f6c91369fdbb161ce5a7858

          SHA512

          02c6054720b5424e1973f2f1546376706d18686cebf0a04b4ab4184f8850099c3e36efabb9add2237ddc0c92613534c15428df73c4921d30a5d4f5447838b980

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w74zb63.exe

          Filesize

          277KB

          MD5

          975cfdea90bac1e372d46a05e0afcf2e

          SHA1

          98edde6d0055c418d2ee7b0dc9d0ee65521ae847

          SHA256

          864d50ecc0bed6118d9c8cb21630dbad4535b3078f6c91369fdbb161ce5a7858

          SHA512

          02c6054720b5424e1973f2f1546376706d18686cebf0a04b4ab4184f8850099c3e36efabb9add2237ddc0c92613534c15428df73c4921d30a5d4f5447838b980

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za123298.exe

          Filesize

          470KB

          MD5

          d4e18ea7b4626d8517efbad215ec1c1e

          SHA1

          b948829a679828613591bec52b8205fd7722f1f6

          SHA256

          801231e84c1f3e7aab9ec58590acb8d28d7081bd08d313fc71b15d69e83b217f

          SHA512

          e710ea36f22d48c21b006858259e391c48df1944145228684e508ddee442df1505e51306ad25c25ab2188f2a64b5cb7f9b1d128fa7ea34b33f86cbc866602517

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za123298.exe

          Filesize

          470KB

          MD5

          d4e18ea7b4626d8517efbad215ec1c1e

          SHA1

          b948829a679828613591bec52b8205fd7722f1f6

          SHA256

          801231e84c1f3e7aab9ec58590acb8d28d7081bd08d313fc71b15d69e83b217f

          SHA512

          e710ea36f22d48c21b006858259e391c48df1944145228684e508ddee442df1505e51306ad25c25ab2188f2a64b5cb7f9b1d128fa7ea34b33f86cbc866602517

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6891.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6891.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2904Rm.exe

          Filesize

          486KB

          MD5

          04a5445c758f90da5e00fbc0beff6a54

          SHA1

          7fb26763a2dbbc1069e709d71a895af897fc6dd7

          SHA256

          ee9a4870fba824a3ee2cf2ca96aa48ba46485f7b7156be85b277f96ace2ce7e0

          SHA512

          8deb42a2749f4feeb74254f23f59b82bc66e016d00615f690b87ccd025439c15313fab44bba9a816bde682d680eaaddd5c8ae71c6783abe6d5fa6e052298f7ec

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2904Rm.exe

          Filesize

          486KB

          MD5

          04a5445c758f90da5e00fbc0beff6a54

          SHA1

          7fb26763a2dbbc1069e709d71a895af897fc6dd7

          SHA256

          ee9a4870fba824a3ee2cf2ca96aa48ba46485f7b7156be85b277f96ace2ce7e0

          SHA512

          8deb42a2749f4feeb74254f23f59b82bc66e016d00615f690b87ccd025439c15313fab44bba9a816bde682d680eaaddd5c8ae71c6783abe6d5fa6e052298f7ec

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

          Filesize

          162B

          MD5

          1b7c22a214949975556626d7217e9a39

          SHA1

          d01c97e2944166ed23e47e4a62ff471ab8fa031f

          SHA256

          340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

          SHA512

          ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

        • memory/756-1013-0x00000000072D0000-0x00000000072E0000-memory.dmp

          Filesize

          64KB

        • memory/756-1012-0x00000000072D0000-0x00000000072E0000-memory.dmp

          Filesize

          64KB

        • memory/756-1011-0x00000000072D0000-0x00000000072E0000-memory.dmp

          Filesize

          64KB

        • memory/756-1010-0x0000000002D00000-0x0000000002D2D000-memory.dmp

          Filesize

          180KB

        • memory/988-182-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-970-0x0000000008B20000-0x0000000008B70000-memory.dmp

          Filesize

          320KB

        • memory/988-200-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-202-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-206-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-204-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-208-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-210-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-212-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-214-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-216-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-218-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-220-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-222-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-224-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-226-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-228-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-230-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-232-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-234-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-963-0x0000000007980000-0x0000000007F98000-memory.dmp

          Filesize

          6.1MB

        • memory/988-964-0x0000000005010000-0x0000000005022000-memory.dmp

          Filesize

          72KB

        • memory/988-965-0x0000000007FA0000-0x00000000080AA000-memory.dmp

          Filesize

          1.0MB

        • memory/988-966-0x00000000080B0000-0x00000000080EC000-memory.dmp

          Filesize

          240KB

        • memory/988-967-0x0000000005040000-0x0000000005050000-memory.dmp

          Filesize

          64KB

        • memory/988-968-0x00000000083B0000-0x0000000008416000-memory.dmp

          Filesize

          408KB

        • memory/988-969-0x0000000008A70000-0x0000000008B02000-memory.dmp

          Filesize

          584KB

        • memory/988-198-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-971-0x0000000008B90000-0x0000000008C06000-memory.dmp

          Filesize

          472KB

        • memory/988-972-0x0000000008D40000-0x0000000008D5E000-memory.dmp

          Filesize

          120KB

        • memory/988-973-0x0000000008E60000-0x0000000009022000-memory.dmp

          Filesize

          1.8MB

        • memory/988-974-0x0000000009030000-0x000000000955C000-memory.dmp

          Filesize

          5.2MB

        • memory/988-196-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-194-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-192-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-185-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-190-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-186-0x0000000005040000-0x0000000005050000-memory.dmp

          Filesize

          64KB

        • memory/988-188-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-184-0x0000000005040000-0x0000000005050000-memory.dmp

          Filesize

          64KB

        • memory/988-167-0x0000000000BB0000-0x0000000000BF6000-memory.dmp

          Filesize

          280KB

        • memory/988-168-0x0000000005050000-0x00000000055F4000-memory.dmp

          Filesize

          5.6MB

        • memory/988-169-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-172-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-180-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-178-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-176-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-174-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/988-170-0x0000000002A70000-0x0000000002AA5000-memory.dmp

          Filesize

          212KB

        • memory/1212-161-0x0000000000C10000-0x0000000000C1A000-memory.dmp

          Filesize

          40KB

        • memory/2292-1816-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/2292-1251-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/2292-1254-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/2292-1250-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB