Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2023, 23:57

General

  • Target

    b7572b0fb36781bd6ee0f12b4fc8a5af9ddea9960268921a4bb2bd5d2bb325f5.exe

  • Size

    1.1MB

  • MD5

    0e1557e622fa0f84fa7cbd2f0a5491f3

  • SHA1

    e21e7e00fb10533f3e93e1664dc21c82550f9343

  • SHA256

    b7572b0fb36781bd6ee0f12b4fc8a5af9ddea9960268921a4bb2bd5d2bb325f5

  • SHA512

    52d2c82fd10939b48a30dbc1b5f8aa7760f7c1bba692c6f813098eaaa05319a365516d758a7ed9178082d806a418fa61d643abdbcfaa491f6ea163bbd8df0f21

  • SSDEEP

    24576:XyqsDHw7tMiMvYu6FzfnAcryW8a5TUwkkq5JxvJ:iQdMvbITAcOBX

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7572b0fb36781bd6ee0f12b4fc8a5af9ddea9960268921a4bb2bd5d2bb325f5.exe
    "C:\Users\Admin\AppData\Local\Temp\b7572b0fb36781bd6ee0f12b4fc8a5af9ddea9960268921a4bb2bd5d2bb325f5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za168572.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za168572.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za575286.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za575286.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za743076.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za743076.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0393.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0393.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3896
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8329AL.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8329AL.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2824
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1328
              6⤵
              • Program crash
              PID:1056
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w65Jk81.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w65Jk81.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4940
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1080
            5⤵
            • Program crash
            PID:1784
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpTFX81.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpTFX81.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4656
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1324
          4⤵
          • Program crash
          PID:2784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86AF20.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86AF20.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4868
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2824 -ip 2824
    1⤵
      PID:2112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4940 -ip 4940
      1⤵
        PID:2688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4656 -ip 4656
        1⤵
          PID:1784
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          1⤵
          • Executes dropped EXE
          PID:3896

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86AF20.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86AF20.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za168572.exe

          Filesize

          903KB

          MD5

          511a5287e3210ac8bcb9cce6a89b7a06

          SHA1

          a11bb52f44832a9e75c1e8cb43c8980345efe897

          SHA256

          a8c678a96e59cb79f8c34bace9328e45452e1f2f3443a1de6e9283d33f5b0b80

          SHA512

          3f4fa48f8e9ab047c1db383f29382868c8754cc3099d407e4d39937a302d7a5b1a09ae86dcd1642892b9db7f1fc345f2a606f2d7ef23036f8a19d19c88ec6e00

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za168572.exe

          Filesize

          903KB

          MD5

          511a5287e3210ac8bcb9cce6a89b7a06

          SHA1

          a11bb52f44832a9e75c1e8cb43c8980345efe897

          SHA256

          a8c678a96e59cb79f8c34bace9328e45452e1f2f3443a1de6e9283d33f5b0b80

          SHA512

          3f4fa48f8e9ab047c1db383f29382868c8754cc3099d407e4d39937a302d7a5b1a09ae86dcd1642892b9db7f1fc345f2a606f2d7ef23036f8a19d19c88ec6e00

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpTFX81.exe

          Filesize

          351KB

          MD5

          31e9895db15bbf57bd6846731377cd4f

          SHA1

          0a3ad505fc15adf319f17f1666b4d60342c73bcb

          SHA256

          97bfec7ed98dc65b7c134024f31e219bf84851c83bf02df412824941b16c51fc

          SHA512

          1e13c038564fef88b1ed95c32eb032215a232e846460c9f4ac2b2ac89822a625e4b0708d5dbd13b9cfb30c94d9b669ff5ca7953dee32bf833d20e8ffb01e871f

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpTFX81.exe

          Filesize

          351KB

          MD5

          31e9895db15bbf57bd6846731377cd4f

          SHA1

          0a3ad505fc15adf319f17f1666b4d60342c73bcb

          SHA256

          97bfec7ed98dc65b7c134024f31e219bf84851c83bf02df412824941b16c51fc

          SHA512

          1e13c038564fef88b1ed95c32eb032215a232e846460c9f4ac2b2ac89822a625e4b0708d5dbd13b9cfb30c94d9b669ff5ca7953dee32bf833d20e8ffb01e871f

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za575286.exe

          Filesize

          677KB

          MD5

          2f88cc259410eb7abd3f0aa8fcf1f6df

          SHA1

          4cfc68ba8e9986f4b33681ce43bb6969a3c74ffa

          SHA256

          6bfd4cfc4c3834bea844cc160ea10b1c8417465bf60bf57c461e598fc4c3475b

          SHA512

          80ffdaeb15dc25580009d1a55d0085d45d66ae571f80c9f300b8d415d5748b690d2bffaf0cb7f88d4e4ff78c0d48a8e0e1f9a00e557724a36ac1b4583c776057

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za575286.exe

          Filesize

          677KB

          MD5

          2f88cc259410eb7abd3f0aa8fcf1f6df

          SHA1

          4cfc68ba8e9986f4b33681ce43bb6969a3c74ffa

          SHA256

          6bfd4cfc4c3834bea844cc160ea10b1c8417465bf60bf57c461e598fc4c3475b

          SHA512

          80ffdaeb15dc25580009d1a55d0085d45d66ae571f80c9f300b8d415d5748b690d2bffaf0cb7f88d4e4ff78c0d48a8e0e1f9a00e557724a36ac1b4583c776057

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w65Jk81.exe

          Filesize

          269KB

          MD5

          06522623efb6efa937c5340d83147486

          SHA1

          8778f91ee4a51b93421d011b7ac788644761ca35

          SHA256

          a4e521f8e8439258d0e7cb63337fb70ab543ee7dea4bf9d9709807b94aafcc1b

          SHA512

          f11a54951380a86d815f342abac23eea761bb9725a4981e1e05d3917fa9d40abf0ee84a445251f3698a5c619f7b22a7ae29edabb089baba6ce3019959912ab91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w65Jk81.exe

          Filesize

          269KB

          MD5

          06522623efb6efa937c5340d83147486

          SHA1

          8778f91ee4a51b93421d011b7ac788644761ca35

          SHA256

          a4e521f8e8439258d0e7cb63337fb70ab543ee7dea4bf9d9709807b94aafcc1b

          SHA512

          f11a54951380a86d815f342abac23eea761bb9725a4981e1e05d3917fa9d40abf0ee84a445251f3698a5c619f7b22a7ae29edabb089baba6ce3019959912ab91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za743076.exe

          Filesize

          405KB

          MD5

          cbe559dcee43f30ec847ca1046957ea0

          SHA1

          f72d8541456739da2aec4f22944e574d44bb2362

          SHA256

          a9742f6903f7d681e356fb482aa1a85aa0dfa219742ec687a5704a69d7c6a80a

          SHA512

          b1f0aa72754a15c68b7144f657daff9a62777f4bf61cde8566fdb7b01f4383349dff49f521439cc90868fd671dfde55152d4989566997043353d93787c55e68f

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za743076.exe

          Filesize

          405KB

          MD5

          cbe559dcee43f30ec847ca1046957ea0

          SHA1

          f72d8541456739da2aec4f22944e574d44bb2362

          SHA256

          a9742f6903f7d681e356fb482aa1a85aa0dfa219742ec687a5704a69d7c6a80a

          SHA512

          b1f0aa72754a15c68b7144f657daff9a62777f4bf61cde8566fdb7b01f4383349dff49f521439cc90868fd671dfde55152d4989566997043353d93787c55e68f

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0393.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0393.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8329AL.exe

          Filesize

          351KB

          MD5

          d04bbc8ae07bcd4c612861653b0b6e83

          SHA1

          e1378724af5c8b50cc89102039980f1b54f3b5c9

          SHA256

          f0502e9b4e7a3ae5e7b6dea51df4e1fd5c9a53e02c6814381c480038978ab9b4

          SHA512

          afe9de49645014768019d52fb612d3029b2aa96b7b15b699a6dba710edaad59e6a7f4b87e797036ef00fa442a915a7d59d510b814c724be1ae19e2fffa0f6cee

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8329AL.exe

          Filesize

          351KB

          MD5

          d04bbc8ae07bcd4c612861653b0b6e83

          SHA1

          e1378724af5c8b50cc89102039980f1b54f3b5c9

          SHA256

          f0502e9b4e7a3ae5e7b6dea51df4e1fd5c9a53e02c6814381c480038978ab9b4

          SHA512

          afe9de49645014768019d52fb612d3029b2aa96b7b15b699a6dba710edaad59e6a7f4b87e797036ef00fa442a915a7d59d510b814c724be1ae19e2fffa0f6cee

        • memory/2824-217-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-967-0x000000000A320000-0x000000000A332000-memory.dmp

          Filesize

          72KB

        • memory/2824-188-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-190-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-192-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-194-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-196-0x0000000007270000-0x0000000007280000-memory.dmp

          Filesize

          64KB

        • memory/2824-197-0x0000000007270000-0x0000000007280000-memory.dmp

          Filesize

          64KB

        • memory/2824-198-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-200-0x0000000007270000-0x0000000007280000-memory.dmp

          Filesize

          64KB

        • memory/2824-201-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-203-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-205-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-207-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-209-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-211-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-213-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-215-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-184-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-219-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-221-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-223-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-225-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-227-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-229-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-233-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-231-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-235-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-966-0x0000000009CB0000-0x000000000A2C8000-memory.dmp

          Filesize

          6.1MB

        • memory/2824-186-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-968-0x000000000A340000-0x000000000A44A000-memory.dmp

          Filesize

          1.0MB

        • memory/2824-969-0x000000000A460000-0x000000000A49C000-memory.dmp

          Filesize

          240KB

        • memory/2824-970-0x0000000007270000-0x0000000007280000-memory.dmp

          Filesize

          64KB

        • memory/2824-971-0x000000000A760000-0x000000000A7C6000-memory.dmp

          Filesize

          408KB

        • memory/2824-972-0x000000000AE20000-0x000000000AEB2000-memory.dmp

          Filesize

          584KB

        • memory/2824-973-0x000000000AFF0000-0x000000000B066000-memory.dmp

          Filesize

          472KB

        • memory/2824-974-0x000000000B0D0000-0x000000000B292000-memory.dmp

          Filesize

          1.8MB

        • memory/2824-975-0x000000000B2A0000-0x000000000B7CC000-memory.dmp

          Filesize

          5.2MB

        • memory/2824-976-0x000000000B850000-0x000000000B86E000-memory.dmp

          Filesize

          120KB

        • memory/2824-182-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-977-0x0000000004C10000-0x0000000004C60000-memory.dmp

          Filesize

          320KB

        • memory/2824-169-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

          Filesize

          280KB

        • memory/2824-170-0x0000000007280000-0x0000000007824000-memory.dmp

          Filesize

          5.6MB

        • memory/2824-171-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-172-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-174-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-176-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-178-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/2824-180-0x0000000007170000-0x00000000071A5000-memory.dmp

          Filesize

          212KB

        • memory/3896-164-0x000000001AE20000-0x000000001AF6E000-memory.dmp

          Filesize

          1.3MB

        • memory/3896-162-0x000000001AE20000-0x000000001AF6E000-memory.dmp

          Filesize

          1.3MB

        • memory/3896-161-0x00000000002D0000-0x00000000002DA000-memory.dmp

          Filesize

          40KB

        • memory/4656-1340-0x00000000072D0000-0x00000000072E0000-memory.dmp

          Filesize

          64KB

        • memory/4656-1341-0x00000000072D0000-0x00000000072E0000-memory.dmp

          Filesize

          64KB

        • memory/4656-1818-0x00000000072D0000-0x00000000072E0000-memory.dmp

          Filesize

          64KB

        • memory/4940-1016-0x00000000071D0000-0x00000000071E0000-memory.dmp

          Filesize

          64KB

        • memory/4940-1015-0x00000000071D0000-0x00000000071E0000-memory.dmp

          Filesize

          64KB

        • memory/4940-1014-0x00000000071D0000-0x00000000071E0000-memory.dmp

          Filesize

          64KB

        • memory/4940-1013-0x0000000002C90000-0x0000000002CBD000-memory.dmp

          Filesize

          180KB