Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 23:50

General

  • Target

    924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe

  • Size

    891KB

  • MD5

    af030c171c81ef7cac612bfe24c9267b

  • SHA1

    7b685524b47db72fc9cb5278dae34aed9c05eedb

  • SHA256

    924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d

  • SHA512

    158810dcb623187f75728c6c6885468c7b88c8bd75679e1fc93139d8040badc62910410ce3c72b0f36f44896c269d927acb0dc76fccc736973489c23d9e39a34

  • SSDEEP

    24576:byqnJoAVpID255CVTR7ZIIhLT5FxtE4C:Oq2A5SdIIhzE

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe
    "C:\Users\Admin\AppData\Local\Temp\924aea018048b51857f00fc7f5093239261f5ed4721328af9b2ffe08c36f679d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za318801.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za318801.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za583548.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za583548.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3344
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1044IA.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1044IA.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1800
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1096
            5⤵
            • Program crash
            PID:4672
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46jN13.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46jN13.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4644
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1324
            5⤵
            • Program crash
            PID:4964
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlCFV16.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlCFV16.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3120
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:8
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4424
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            5⤵
            • Loads dropped DLL
            PID:4028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys016587.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys016587.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2228
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1320
        3⤵
        • Program crash
        PID:4340
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1800 -ip 1800
    1⤵
      PID:1364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4644 -ip 4644
      1⤵
        PID:2904
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:3508
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2228 -ip 2228
        1⤵
          PID:5020
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          1⤵
          • Executes dropped EXE
          PID:1888

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

                Filesize

                229KB

                MD5

                3308051ded87b1863a8d92925202c4b3

                SHA1

                7834ddc23e7976b07118fb580ae38234466dbdfb

                SHA256

                13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

                SHA512

                f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

              • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

                Filesize

                229KB

                MD5

                3308051ded87b1863a8d92925202c4b3

                SHA1

                7834ddc23e7976b07118fb580ae38234466dbdfb

                SHA256

                13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

                SHA512

                f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

              • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

                Filesize

                229KB

                MD5

                3308051ded87b1863a8d92925202c4b3

                SHA1

                7834ddc23e7976b07118fb580ae38234466dbdfb

                SHA256

                13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

                SHA512

                f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

              • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

                Filesize

                229KB

                MD5

                3308051ded87b1863a8d92925202c4b3

                SHA1

                7834ddc23e7976b07118fb580ae38234466dbdfb

                SHA256

                13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

                SHA512

                f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

              • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

                Filesize

                229KB

                MD5

                3308051ded87b1863a8d92925202c4b3

                SHA1

                7834ddc23e7976b07118fb580ae38234466dbdfb

                SHA256

                13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

                SHA512

                f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys016587.exe

                Filesize

                361KB

                MD5

                d4999b84045618caf469527361753b26

                SHA1

                dea7471dcd62344030ff874c1a08acb85f802c8d

                SHA256

                0934150dffa7e56590d4d5d6a6477668f053daac2565b4fb464c42fcdc521f28

                SHA512

                67017cae4563dc5fb8cf75f61457af3dda1df92057ad8569b8f60c47fd1c5ee8ece98f412bac32bb6632f23a0e6da4c23e3c0f36383fc40caaafc6de905fa599

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys016587.exe

                Filesize

                361KB

                MD5

                d4999b84045618caf469527361753b26

                SHA1

                dea7471dcd62344030ff874c1a08acb85f802c8d

                SHA256

                0934150dffa7e56590d4d5d6a6477668f053daac2565b4fb464c42fcdc521f28

                SHA512

                67017cae4563dc5fb8cf75f61457af3dda1df92057ad8569b8f60c47fd1c5ee8ece98f412bac32bb6632f23a0e6da4c23e3c0f36383fc40caaafc6de905fa599

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za318801.exe

                Filesize

                732KB

                MD5

                ca66a1928e41037904231cb6c0bcf161

                SHA1

                0dac05dc019cd0c854fa4366ec138270a302b340

                SHA256

                ab515b1ef9bfba224e333742ffb300c6f0be764d364e41fbf699ff5bb6225ec8

                SHA512

                c04ac044b207522df21beee37b532add532b4227ef9ac2776eec36a0265922c67fcfc3b9c9df4549c4ed4f4ff5db57bf63e05459a2435ef38d7fe4c2840f9fe9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za318801.exe

                Filesize

                732KB

                MD5

                ca66a1928e41037904231cb6c0bcf161

                SHA1

                0dac05dc019cd0c854fa4366ec138270a302b340

                SHA256

                ab515b1ef9bfba224e333742ffb300c6f0be764d364e41fbf699ff5bb6225ec8

                SHA512

                c04ac044b207522df21beee37b532add532b4227ef9ac2776eec36a0265922c67fcfc3b9c9df4549c4ed4f4ff5db57bf63e05459a2435ef38d7fe4c2840f9fe9

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlCFV16.exe

                Filesize

                229KB

                MD5

                3308051ded87b1863a8d92925202c4b3

                SHA1

                7834ddc23e7976b07118fb580ae38234466dbdfb

                SHA256

                13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

                SHA512

                f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xlCFV16.exe

                Filesize

                229KB

                MD5

                3308051ded87b1863a8d92925202c4b3

                SHA1

                7834ddc23e7976b07118fb580ae38234466dbdfb

                SHA256

                13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

                SHA512

                f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za583548.exe

                Filesize

                549KB

                MD5

                d8cb212706acb6f00ccf9edceb2337f5

                SHA1

                e58bf15cda3b72daf88bd2301fceda666d04db42

                SHA256

                6bb0443f1c045e9036ec4f18988fbb05bf4b5536abaea58911b6a84e0a868c13

                SHA512

                b4ffd4f5a1200aa37dc34dfa39badaa2dd26b3331a257e57f54c602b8858672980de6c02a85947489c79cc8294845fa78d333a3ecece59b8cd43946137e831a8

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za583548.exe

                Filesize

                549KB

                MD5

                d8cb212706acb6f00ccf9edceb2337f5

                SHA1

                e58bf15cda3b72daf88bd2301fceda666d04db42

                SHA256

                6bb0443f1c045e9036ec4f18988fbb05bf4b5536abaea58911b6a84e0a868c13

                SHA512

                b4ffd4f5a1200aa37dc34dfa39badaa2dd26b3331a257e57f54c602b8858672980de6c02a85947489c79cc8294845fa78d333a3ecece59b8cd43946137e831a8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1044IA.exe

                Filesize

                278KB

                MD5

                bda682fff8d5f135e70b23e96eab9ec2

                SHA1

                f2a6da759a4cd57289346e80851c23352d301ed7

                SHA256

                0536bfa9104733baf9bbfeb13d37ba81928eea64db222de3bad2dc29256ea369

                SHA512

                4dc8c92873768c7c21d1ddd63a0eb67e34ea25be438cdb3733860e0a31a248d860c99ea49856225b35cbeea0b52ed42509a8ee1bdbaa1da4ed0fbef438f3deea

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1044IA.exe

                Filesize

                278KB

                MD5

                bda682fff8d5f135e70b23e96eab9ec2

                SHA1

                f2a6da759a4cd57289346e80851c23352d301ed7

                SHA256

                0536bfa9104733baf9bbfeb13d37ba81928eea64db222de3bad2dc29256ea369

                SHA512

                4dc8c92873768c7c21d1ddd63a0eb67e34ea25be438cdb3733860e0a31a248d860c99ea49856225b35cbeea0b52ed42509a8ee1bdbaa1da4ed0fbef438f3deea

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46jN13.exe

                Filesize

                361KB

                MD5

                c3d9c42a86fc1c144a1aa7c4ea36ae4d

                SHA1

                a4038ddfc9f572cc5d4cc4cd2cdb450942ad1ed0

                SHA256

                7965fb841ceed81e6de270446fef0f61822c899082c6b0c41e183f092099b5be

                SHA512

                665e92a556dc9e4eed0e2c2432d60df7ecee7f55b0ae75a2937ffdb50039ec2b60ce61d5c80e220e3bc0d333fc0a63fd303ae95c759e21dc341d99f7487e1477

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46jN13.exe

                Filesize

                361KB

                MD5

                c3d9c42a86fc1c144a1aa7c4ea36ae4d

                SHA1

                a4038ddfc9f572cc5d4cc4cd2cdb450942ad1ed0

                SHA256

                7965fb841ceed81e6de270446fef0f61822c899082c6b0c41e183f092099b5be

                SHA512

                665e92a556dc9e4eed0e2c2432d60df7ecee7f55b0ae75a2937ffdb50039ec2b60ce61d5c80e220e3bc0d333fc0a63fd303ae95c759e21dc341d99f7487e1477

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                Filesize

                89KB

                MD5

                73df88d68a4f5e066784d462788cf695

                SHA1

                e4bfed336848d0b622fa464d40cf4bd9222aab3f

                SHA256

                f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

                SHA512

                64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                Filesize

                89KB

                MD5

                73df88d68a4f5e066784d462788cf695

                SHA1

                e4bfed336848d0b622fa464d40cf4bd9222aab3f

                SHA256

                f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

                SHA512

                64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                Filesize

                89KB

                MD5

                73df88d68a4f5e066784d462788cf695

                SHA1

                e4bfed336848d0b622fa464d40cf4bd9222aab3f

                SHA256

                f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

                SHA512

                64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1800-156-0x00000000072E0000-0x0000000007884000-memory.dmp

                Filesize

                5.6MB

              • memory/1800-192-0x0000000000400000-0x0000000002BAF000-memory.dmp

                Filesize

                39.7MB

              • memory/1800-176-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-178-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-180-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-183-0x00000000072D0000-0x00000000072E0000-memory.dmp

                Filesize

                64KB

              • memory/1800-184-0x00000000072D0000-0x00000000072E0000-memory.dmp

                Filesize

                64KB

              • memory/1800-182-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-186-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-187-0x00000000072D0000-0x00000000072E0000-memory.dmp

                Filesize

                64KB

              • memory/1800-188-0x0000000000400000-0x0000000002BAF000-memory.dmp

                Filesize

                39.7MB

              • memory/1800-190-0x00000000072D0000-0x00000000072E0000-memory.dmp

                Filesize

                64KB

              • memory/1800-191-0x00000000072D0000-0x00000000072E0000-memory.dmp

                Filesize

                64KB

              • memory/1800-174-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-172-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-170-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-168-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-166-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-164-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-162-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-160-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-155-0x0000000002C80000-0x0000000002CAD000-memory.dmp

                Filesize

                180KB

              • memory/1800-158-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/1800-157-0x0000000007120000-0x0000000007132000-memory.dmp

                Filesize

                72KB

              • memory/2228-1236-0x0000000007240000-0x0000000007250000-memory.dmp

                Filesize

                64KB

              • memory/2228-1233-0x0000000007240000-0x0000000007250000-memory.dmp

                Filesize

                64KB

              • memory/2228-1818-0x0000000007240000-0x0000000007250000-memory.dmp

                Filesize

                64KB

              • memory/4644-206-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-221-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-223-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-225-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-227-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-229-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-231-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-233-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-992-0x0000000009C70000-0x000000000A288000-memory.dmp

                Filesize

                6.1MB

              • memory/4644-993-0x000000000A320000-0x000000000A332000-memory.dmp

                Filesize

                72KB

              • memory/4644-994-0x000000000A340000-0x000000000A44A000-memory.dmp

                Filesize

                1.0MB

              • memory/4644-995-0x000000000A460000-0x000000000A49C000-memory.dmp

                Filesize

                240KB

              • memory/4644-996-0x00000000071F0000-0x0000000007200000-memory.dmp

                Filesize

                64KB

              • memory/4644-997-0x000000000A760000-0x000000000A7C6000-memory.dmp

                Filesize

                408KB

              • memory/4644-998-0x000000000AF70000-0x000000000B002000-memory.dmp

                Filesize

                584KB

              • memory/4644-999-0x000000000B130000-0x000000000B180000-memory.dmp

                Filesize

                320KB

              • memory/4644-1000-0x000000000B180000-0x000000000B1F6000-memory.dmp

                Filesize

                472KB

              • memory/4644-219-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-217-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-215-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-213-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-210-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-211-0x00000000071F0000-0x0000000007200000-memory.dmp

                Filesize

                64KB

              • memory/4644-209-0x00000000071F0000-0x0000000007200000-memory.dmp

                Filesize

                64KB

              • memory/4644-207-0x0000000002BD0000-0x0000000002C16000-memory.dmp

                Filesize

                280KB

              • memory/4644-204-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-202-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-200-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-198-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-197-0x0000000007170000-0x00000000071A5000-memory.dmp

                Filesize

                212KB

              • memory/4644-1001-0x000000000B230000-0x000000000B24E000-memory.dmp

                Filesize

                120KB

              • memory/4644-1002-0x000000000B550000-0x000000000B712000-memory.dmp

                Filesize

                1.8MB

              • memory/4644-1003-0x000000000B720000-0x000000000BC4C000-memory.dmp

                Filesize

                5.2MB