Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2023, 01:17

General

  • Target

    82cec82268a352b137213daf42a7127d5f8fdf47efd02675eaf166907e03943e.exe

  • Size

    1.2MB

  • MD5

    b6471aca14b0edd16040e04806dfe577

  • SHA1

    39c1119908e5cd0725aa7ee4f554aec8a54f4420

  • SHA256

    82cec82268a352b137213daf42a7127d5f8fdf47efd02675eaf166907e03943e

  • SHA512

    c2de0cf919df0881a0b1214148505f972e8383561337852b88a3804c6aee115c76b1db38e76d22166907fa4b07666bba6e6973f4f7dee7988fcd65556ffc983d

  • SSDEEP

    24576:bygN+2K2HN3nJ0BInZHFreJYTePZwmLJiLhFjstQPSKevNFYL3RziDzKs:ON27N3SBInNFruYiHoLrPSKevNFYL3RF

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82cec82268a352b137213daf42a7127d5f8fdf47efd02675eaf166907e03943e.exe
    "C:\Users\Admin\AppData\Local\Temp\82cec82268a352b137213daf42a7127d5f8fdf47efd02675eaf166907e03943e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za481911.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za481911.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3696
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za196838.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za196838.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za575756.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za575756.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3332
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7863.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7863.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2264
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6942ZS.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6942ZS.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2672
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1320
              6⤵
              • Program crash
              PID:1312
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w81SB48.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w81SB48.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4668
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1092
            5⤵
            • Program crash
            PID:4336
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xPXJK47.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xPXJK47.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 1752
          4⤵
          • Program crash
          PID:3400
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03rz00.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03rz00.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4464
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          4⤵
          • Loads dropped DLL
          PID:1664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2672 -ip 2672
    1⤵
      PID:460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4668 -ip 4668
      1⤵
        PID:4640
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2932 -ip 2932
        1⤵
          PID:4216
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          1⤵
          • Executes dropped EXE
          PID:4544

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03rz00.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y03rz00.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za481911.exe

          Filesize

          1.1MB

          MD5

          eae29c080a853cb7d70fe0dd81c5585e

          SHA1

          50e66a53481a9bd0922727b647594beb9927c15e

          SHA256

          5e5caed16c752c212d05cc2f43ddcead9399e303244e2a1cbda4c78ba56b86e0

          SHA512

          6a567db533ab4176e6ae06f75102bf33fb40279aa1c642ee7a7952efbff00503e062d037d79fde93f58ab11dc5bef6dc46d8111c664136eea194bfd82e202c16

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za481911.exe

          Filesize

          1.1MB

          MD5

          eae29c080a853cb7d70fe0dd81c5585e

          SHA1

          50e66a53481a9bd0922727b647594beb9927c15e

          SHA256

          5e5caed16c752c212d05cc2f43ddcead9399e303244e2a1cbda4c78ba56b86e0

          SHA512

          6a567db533ab4176e6ae06f75102bf33fb40279aa1c642ee7a7952efbff00503e062d037d79fde93f58ab11dc5bef6dc46d8111c664136eea194bfd82e202c16

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xPXJK47.exe

          Filesize

          474KB

          MD5

          ea4b89238680fc2c558129176be15f3e

          SHA1

          3acc4070bc7b8b7ad51c360b7f2fc1888c248844

          SHA256

          6cc8eaa012fac7eb0aab5d71ebc052e2404733f24c86ffb205b41e140fc62f50

          SHA512

          750a15d439d5ccdb6ed0eb4912e38d3ec46fb2b210b3ef78e7aebb51ea829d71ec294a192e7ae37961cfec8cfd0bd545c40335876fe0d7dd7b4abea8acaa7cc5

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xPXJK47.exe

          Filesize

          474KB

          MD5

          ea4b89238680fc2c558129176be15f3e

          SHA1

          3acc4070bc7b8b7ad51c360b7f2fc1888c248844

          SHA256

          6cc8eaa012fac7eb0aab5d71ebc052e2404733f24c86ffb205b41e140fc62f50

          SHA512

          750a15d439d5ccdb6ed0eb4912e38d3ec46fb2b210b3ef78e7aebb51ea829d71ec294a192e7ae37961cfec8cfd0bd545c40335876fe0d7dd7b4abea8acaa7cc5

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za196838.exe

          Filesize

          790KB

          MD5

          0ceb2229aae0095c6840161756fed062

          SHA1

          ebf9901654be1f63c16fafb5666e1c4241fb7567

          SHA256

          93fcc97e3e4f201b6f55818579cfb67cb60e0c68e06327e6b0bef804e15c64de

          SHA512

          ba5df36c67fd9db22f68e59d5b2349c92216c6b3943ad99eca85a4173a10ae4af17ee4bdf61d777ab359487bbe5bcf1146b72a2feeafa334624136affe41c1fc

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za196838.exe

          Filesize

          790KB

          MD5

          0ceb2229aae0095c6840161756fed062

          SHA1

          ebf9901654be1f63c16fafb5666e1c4241fb7567

          SHA256

          93fcc97e3e4f201b6f55818579cfb67cb60e0c68e06327e6b0bef804e15c64de

          SHA512

          ba5df36c67fd9db22f68e59d5b2349c92216c6b3943ad99eca85a4173a10ae4af17ee4bdf61d777ab359487bbe5bcf1146b72a2feeafa334624136affe41c1fc

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w81SB48.exe

          Filesize

          391KB

          MD5

          97eeb1b8c398fff9dafc4e6cdfd1628b

          SHA1

          b70bd2095e375d50cc7a61ae8360f40c86edf3ef

          SHA256

          a1900e6cca97c3057a2c7a176833d93c2093b75a5b47f2406d2da1f10c84963a

          SHA512

          8bf0aaab7b547ceb479451c217efe49e281e7c4034585425a7852f41540547959f3c1301d68e8fb0954bcfd9e9a23f80f5247a1c40c9ec8b56964b92ff19e71b

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w81SB48.exe

          Filesize

          391KB

          MD5

          97eeb1b8c398fff9dafc4e6cdfd1628b

          SHA1

          b70bd2095e375d50cc7a61ae8360f40c86edf3ef

          SHA256

          a1900e6cca97c3057a2c7a176833d93c2093b75a5b47f2406d2da1f10c84963a

          SHA512

          8bf0aaab7b547ceb479451c217efe49e281e7c4034585425a7852f41540547959f3c1301d68e8fb0954bcfd9e9a23f80f5247a1c40c9ec8b56964b92ff19e71b

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za575756.exe

          Filesize

          462KB

          MD5

          a8764caf2293eb893e80c886b2bb6993

          SHA1

          dca41e5ef4ea9b5cab66cfbb51de7086828b5f47

          SHA256

          bb13e36bbea83615353cd228127223d4985adda9882ffecd8fd85e13983ec116

          SHA512

          381ca14346bcb6676878dc7cc683b3aea404c24297b7ff4d6d2e3140c973cabab1121ea89c3b17251d80960a56d76690773487058e37a3cff3175c6db4efb170

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za575756.exe

          Filesize

          462KB

          MD5

          a8764caf2293eb893e80c886b2bb6993

          SHA1

          dca41e5ef4ea9b5cab66cfbb51de7086828b5f47

          SHA256

          bb13e36bbea83615353cd228127223d4985adda9882ffecd8fd85e13983ec116

          SHA512

          381ca14346bcb6676878dc7cc683b3aea404c24297b7ff4d6d2e3140c973cabab1121ea89c3b17251d80960a56d76690773487058e37a3cff3175c6db4efb170

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7863.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7863.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6942ZS.exe

          Filesize

          474KB

          MD5

          7632cd8da3e0765a4144f29e85d98dfb

          SHA1

          bf7b71c16e004265506bd3a5bcfbc1f93c2d0423

          SHA256

          f8f26dcd8cd4c14bbf8249f36abf9f24a8924d995c1cf711c5632f1f32169921

          SHA512

          e78c345257dc22e12aab611f78511b100dfad11baeeceb4c2670a6a7512d03ed403b63d6692399cfdcb515d127f3a10554e612e9877f8f53ca2ada0052a1bf78

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6942ZS.exe

          Filesize

          474KB

          MD5

          7632cd8da3e0765a4144f29e85d98dfb

          SHA1

          bf7b71c16e004265506bd3a5bcfbc1f93c2d0423

          SHA256

          f8f26dcd8cd4c14bbf8249f36abf9f24a8924d995c1cf711c5632f1f32169921

          SHA512

          e78c345257dc22e12aab611f78511b100dfad11baeeceb4c2670a6a7512d03ed403b63d6692399cfdcb515d127f3a10554e612e9877f8f53ca2ada0052a1bf78

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

          Filesize

          162B

          MD5

          1b7c22a214949975556626d7217e9a39

          SHA1

          d01c97e2944166ed23e47e4a62ff471ab8fa031f

          SHA256

          340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

          SHA512

          ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

        • memory/2264-161-0x00000000004D0000-0x00000000004DA000-memory.dmp

          Filesize

          40KB

        • memory/2672-223-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-971-0x0000000008C60000-0x0000000008CD6000-memory.dmp

          Filesize

          472KB

        • memory/2672-193-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-195-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-197-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-199-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-201-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-203-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-205-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-207-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-209-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-211-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-213-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-215-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-217-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-219-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-221-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-189-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-225-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-227-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-229-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-231-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-235-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-233-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-964-0x0000000007A10000-0x0000000008028000-memory.dmp

          Filesize

          6.1MB

        • memory/2672-965-0x00000000080B0000-0x00000000080C2000-memory.dmp

          Filesize

          72KB

        • memory/2672-966-0x00000000080D0000-0x00000000081DA000-memory.dmp

          Filesize

          1.0MB

        • memory/2672-967-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/2672-968-0x00000000081F0000-0x000000000822C000-memory.dmp

          Filesize

          240KB

        • memory/2672-969-0x00000000084F0000-0x0000000008556000-memory.dmp

          Filesize

          408KB

        • memory/2672-970-0x0000000008BC0000-0x0000000008C52000-memory.dmp

          Filesize

          584KB

        • memory/2672-191-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-972-0x0000000008D20000-0x0000000008D3E000-memory.dmp

          Filesize

          120KB

        • memory/2672-973-0x0000000008F40000-0x0000000009102000-memory.dmp

          Filesize

          1.8MB

        • memory/2672-974-0x0000000009110000-0x000000000963C000-memory.dmp

          Filesize

          5.2MB

        • memory/2672-976-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/2672-977-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/2672-978-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/2672-979-0x00000000028B0000-0x0000000002900000-memory.dmp

          Filesize

          320KB

        • memory/2672-187-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-185-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-167-0x0000000000AA0000-0x0000000000AE6000-memory.dmp

          Filesize

          280KB

        • memory/2672-168-0x00000000050E0000-0x0000000005684000-memory.dmp

          Filesize

          5.6MB

        • memory/2672-169-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/2672-170-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/2672-183-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-181-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-171-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/2672-173-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-172-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-175-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-179-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2672-177-0x0000000004F30000-0x0000000004F65000-memory.dmp

          Filesize

          212KB

        • memory/2932-1820-0x0000000004F90000-0x0000000004FA0000-memory.dmp

          Filesize

          64KB

        • memory/2932-1101-0x0000000004F90000-0x0000000004FA0000-memory.dmp

          Filesize

          64KB

        • memory/2932-1102-0x0000000004F90000-0x0000000004FA0000-memory.dmp

          Filesize

          64KB

        • memory/2932-1099-0x0000000004F90000-0x0000000004FA0000-memory.dmp

          Filesize

          64KB

        • memory/4668-1017-0x0000000004F20000-0x0000000004F30000-memory.dmp

          Filesize

          64KB

        • memory/4668-1016-0x0000000004F20000-0x0000000004F30000-memory.dmp

          Filesize

          64KB

        • memory/4668-1015-0x0000000004F20000-0x0000000004F30000-memory.dmp

          Filesize

          64KB

        • memory/4668-1014-0x0000000002470000-0x000000000249D000-memory.dmp

          Filesize

          180KB