Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2023, 16:48

General

  • Target

    11bae57125122ba12dd4f19bcbd3e588b5d18cc0e55259b84c0c0f6f379bc249.exe

  • Size

    851KB

  • MD5

    ebacbddff0ea50b468f2cc998e390e5d

  • SHA1

    0844bbd8de13bfdd9be6a693c101f74aa21bec96

  • SHA256

    11bae57125122ba12dd4f19bcbd3e588b5d18cc0e55259b84c0c0f6f379bc249

  • SHA512

    c48f977d92b39c4e5c2ab7b4496b823c2af97185847d1f01c541177753da36d7d05b3dc5ee5a4ddf87ff5d644c94eb924795a20312e1557e83000894006c692b

  • SSDEEP

    12288:5y90Ue0NMycKy6cqGqb2v0FRJQqnt2xG5WQb6ul+Yx6D6S0ySsA+pdWXWBSWTWEu:5yX+ycmbK0FDajYX+Yk6SVA4TPGlWMd

Malware Config

Extracted

Family

amadey

Version

3.70

C2

77.91.124.207/plays/chapter/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11bae57125122ba12dd4f19bcbd3e588b5d18cc0e55259b84c0c0f6f379bc249.exe
    "C:\Users\Admin\AppData\Local\Temp\11bae57125122ba12dd4f19bcbd3e588b5d18cc0e55259b84c0c0f6f379bc249.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki982732.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki982732.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki413736.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki413736.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az698877.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az698877.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1160
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu413480.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu413480.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3748
          • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4708
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:3628
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
              6⤵
              • Loads dropped DLL
              PID:4744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft208878.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft208878.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 988
          4⤵
          • Program crash
          PID:2472
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge705804.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge705804.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1468
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1328
        3⤵
        • Program crash
        PID:3832
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 208 -ip 208
    1⤵
      PID:3884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1468 -ip 1468
      1⤵
        PID:5000
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:5052
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:4760

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

        Filesize

        229KB

        MD5

        6c07711a17452b855149a95cda6fc830

        SHA1

        5b3252c2567de78f9ae68764d4e30511a509fdcc

        SHA256

        eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

        SHA512

        ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

        Filesize

        229KB

        MD5

        6c07711a17452b855149a95cda6fc830

        SHA1

        5b3252c2567de78f9ae68764d4e30511a509fdcc

        SHA256

        eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

        SHA512

        ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

        Filesize

        229KB

        MD5

        6c07711a17452b855149a95cda6fc830

        SHA1

        5b3252c2567de78f9ae68764d4e30511a509fdcc

        SHA256

        eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

        SHA512

        ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

        Filesize

        229KB

        MD5

        6c07711a17452b855149a95cda6fc830

        SHA1

        5b3252c2567de78f9ae68764d4e30511a509fdcc

        SHA256

        eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

        SHA512

        ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

        Filesize

        229KB

        MD5

        6c07711a17452b855149a95cda6fc830

        SHA1

        5b3252c2567de78f9ae68764d4e30511a509fdcc

        SHA256

        eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

        SHA512

        ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge705804.exe

        Filesize

        350KB

        MD5

        9e7ddafbb6a05f409e2eb94c312629d9

        SHA1

        b1f5b2c18d4920656926b768fcf7060bb08787da

        SHA256

        0c2d6f7089f90c37136022e898128e660c3b7768509a69be8bee6de078306ddc

        SHA512

        fe163eb1ac3ad008844db31dd9109883f1b1d7cc4c7cb6d503f74665f843bac6440a94c307d3bbafddfffc9cb52629f4eadb8436de33c775cb8b92903997b7be

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge705804.exe

        Filesize

        350KB

        MD5

        9e7ddafbb6a05f409e2eb94c312629d9

        SHA1

        b1f5b2c18d4920656926b768fcf7060bb08787da

        SHA256

        0c2d6f7089f90c37136022e898128e660c3b7768509a69be8bee6de078306ddc

        SHA512

        fe163eb1ac3ad008844db31dd9109883f1b1d7cc4c7cb6d503f74665f843bac6440a94c307d3bbafddfffc9cb52629f4eadb8436de33c775cb8b92903997b7be

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki982732.exe

        Filesize

        504KB

        MD5

        ad6e433c7615326533bf88e4f549354e

        SHA1

        11b4080116df43a087f3987be95a0ce3963a03c1

        SHA256

        f78eae433990b2beb0193776cdee06ff7f15db000028dff3d1cb4c3a4dc7bdad

        SHA512

        609ba92421112cfd615fc3b60bd7ef8bb0f761de504ff75b7d830cb917aacb2d8d45bccce3a0aadc292fc890a20de9f7a6d5a3d4574298b2c5eba821284e1b87

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki982732.exe

        Filesize

        504KB

        MD5

        ad6e433c7615326533bf88e4f549354e

        SHA1

        11b4080116df43a087f3987be95a0ce3963a03c1

        SHA256

        f78eae433990b2beb0193776cdee06ff7f15db000028dff3d1cb4c3a4dc7bdad

        SHA512

        609ba92421112cfd615fc3b60bd7ef8bb0f761de504ff75b7d830cb917aacb2d8d45bccce3a0aadc292fc890a20de9f7a6d5a3d4574298b2c5eba821284e1b87

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft208878.exe

        Filesize

        278KB

        MD5

        954f28bc736a0ae8c01ad64fd8695295

        SHA1

        f2b8808e1207044cf4547e28488dd2fd1a5aca00

        SHA256

        2b4db04738daefe6db7b272f237c796ee10ea5bba4e2f8039974a31c951b121b

        SHA512

        35bafb0011c2b0b7d78ea0e294d14c325d669f4da779ea6e7ce26a8b8557b8a0a9150e2a80667d75a72df5c56d4ffb109ac8300dfcdf0c00b21ad1a66a14e126

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ft208878.exe

        Filesize

        278KB

        MD5

        954f28bc736a0ae8c01ad64fd8695295

        SHA1

        f2b8808e1207044cf4547e28488dd2fd1a5aca00

        SHA256

        2b4db04738daefe6db7b272f237c796ee10ea5bba4e2f8039974a31c951b121b

        SHA512

        35bafb0011c2b0b7d78ea0e294d14c325d669f4da779ea6e7ce26a8b8557b8a0a9150e2a80667d75a72df5c56d4ffb109ac8300dfcdf0c00b21ad1a66a14e126

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki413736.exe

        Filesize

        234KB

        MD5

        9367556c451fe6d550f42cc8ad134288

        SHA1

        a11396f7454dc51d7c06b5e144b01ffed91c494f

        SHA256

        ff673b0e5298a5e9a4a5b8583af52e518883dac6fd53463f579f3fad4b8d5dea

        SHA512

        4ec09ffaf542fb57d83d917062f6ed512c275cb39768e95a5ee8d34852219dd1f440fb89a37629f92a0bb8ad7766945fcaba67bf7bffa512d8a794ce62898ae2

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki413736.exe

        Filesize

        234KB

        MD5

        9367556c451fe6d550f42cc8ad134288

        SHA1

        a11396f7454dc51d7c06b5e144b01ffed91c494f

        SHA256

        ff673b0e5298a5e9a4a5b8583af52e518883dac6fd53463f579f3fad4b8d5dea

        SHA512

        4ec09ffaf542fb57d83d917062f6ed512c275cb39768e95a5ee8d34852219dd1f440fb89a37629f92a0bb8ad7766945fcaba67bf7bffa512d8a794ce62898ae2

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az698877.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az698877.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu413480.exe

        Filesize

        229KB

        MD5

        6c07711a17452b855149a95cda6fc830

        SHA1

        5b3252c2567de78f9ae68764d4e30511a509fdcc

        SHA256

        eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

        SHA512

        ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu413480.exe

        Filesize

        229KB

        MD5

        6c07711a17452b855149a95cda6fc830

        SHA1

        5b3252c2567de78f9ae68764d4e30511a509fdcc

        SHA256

        eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

        SHA512

        ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

        Filesize

        89KB

        MD5

        4061d8dd5006b99d06fa208c0063dfcf

        SHA1

        38e7df8d8e631f3e9b227df3b9326d187e18cce5

        SHA256

        b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

        SHA512

        71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

        Filesize

        89KB

        MD5

        4061d8dd5006b99d06fa208c0063dfcf

        SHA1

        38e7df8d8e631f3e9b227df3b9326d187e18cce5

        SHA256

        b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

        SHA512

        71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

        Filesize

        89KB

        MD5

        4061d8dd5006b99d06fa208c0063dfcf

        SHA1

        38e7df8d8e631f3e9b227df3b9326d187e18cce5

        SHA256

        b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

        SHA512

        71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

        Filesize

        162B

        MD5

        1b7c22a214949975556626d7217e9a39

        SHA1

        d01c97e2944166ed23e47e4a62ff471ab8fa031f

        SHA256

        340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

        SHA512

        ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

      • memory/208-181-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-206-0x0000000000400000-0x0000000002BA0000-memory.dmp

        Filesize

        39.6MB

      • memory/208-185-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-187-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-189-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-191-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-193-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-195-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-197-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-199-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-201-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-203-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-205-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-183-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-207-0x0000000007190000-0x00000000071A0000-memory.dmp

        Filesize

        64KB

      • memory/208-208-0x0000000007190000-0x00000000071A0000-memory.dmp

        Filesize

        64KB

      • memory/208-209-0x0000000007190000-0x00000000071A0000-memory.dmp

        Filesize

        64KB

      • memory/208-211-0x0000000000400000-0x0000000002BA0000-memory.dmp

        Filesize

        39.6MB

      • memory/208-179-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-178-0x0000000007100000-0x0000000007112000-memory.dmp

        Filesize

        72KB

      • memory/208-175-0x0000000007190000-0x00000000071A0000-memory.dmp

        Filesize

        64KB

      • memory/208-173-0x00000000071A0000-0x0000000007744000-memory.dmp

        Filesize

        5.6MB

      • memory/208-174-0x0000000002F20000-0x0000000002F4D000-memory.dmp

        Filesize

        180KB

      • memory/208-176-0x0000000007190000-0x00000000071A0000-memory.dmp

        Filesize

        64KB

      • memory/208-177-0x0000000007190000-0x00000000071A0000-memory.dmp

        Filesize

        64KB

      • memory/1160-154-0x00000000007C0000-0x00000000007CA000-memory.dmp

        Filesize

        40KB

      • memory/1468-234-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-1013-0x0000000009D00000-0x0000000009D12000-memory.dmp

        Filesize

        72KB

      • memory/1468-230-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-226-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-236-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-232-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-238-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-240-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-242-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-244-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-246-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-248-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-250-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-279-0x0000000004A50000-0x0000000004A60000-memory.dmp

        Filesize

        64KB

      • memory/1468-281-0x0000000004A50000-0x0000000004A60000-memory.dmp

        Filesize

        64KB

      • memory/1468-282-0x0000000004A50000-0x0000000004A60000-memory.dmp

        Filesize

        64KB

      • memory/1468-1012-0x000000000A320000-0x000000000A938000-memory.dmp

        Filesize

        6.1MB

      • memory/1468-228-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-1014-0x0000000009D20000-0x0000000009E2A000-memory.dmp

        Filesize

        1.0MB

      • memory/1468-1015-0x0000000009E40000-0x0000000009E7C000-memory.dmp

        Filesize

        240KB

      • memory/1468-1016-0x0000000004A50000-0x0000000004A60000-memory.dmp

        Filesize

        64KB

      • memory/1468-1017-0x000000000A130000-0x000000000A196000-memory.dmp

        Filesize

        408KB

      • memory/1468-1018-0x000000000AE00000-0x000000000AE92000-memory.dmp

        Filesize

        584KB

      • memory/1468-1019-0x000000000AFD0000-0x000000000B020000-memory.dmp

        Filesize

        320KB

      • memory/1468-1020-0x000000000B030000-0x000000000B0A6000-memory.dmp

        Filesize

        472KB

      • memory/1468-1021-0x000000000B100000-0x000000000B2C2000-memory.dmp

        Filesize

        1.8MB

      • memory/1468-1022-0x000000000B2F0000-0x000000000B81C000-memory.dmp

        Filesize

        5.2MB

      • memory/1468-1023-0x000000000B920000-0x000000000B93E000-memory.dmp

        Filesize

        120KB

      • memory/1468-224-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-222-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-220-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-218-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-217-0x0000000004C00000-0x0000000004C35000-memory.dmp

        Filesize

        212KB

      • memory/1468-216-0x0000000003100000-0x0000000003146000-memory.dmp

        Filesize

        280KB