Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2023, 01:05

General

  • Target

    7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe

  • Size

    940KB

  • MD5

    5ecbb5b5488ac14dab93399b21c16db3

  • SHA1

    a5e534c28a775553faa9ebddef9fcd56dd8dc0b8

  • SHA256

    7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2

  • SHA512

    9957bceea81cac651468d23010fa08ef4ca0fc2b41461567587408933b50b50f18629f5e0d6a6ae9379721c19bbd27ba417138405bd7c1c158444435ea0c34e9

  • SSDEEP

    24576:OyuCmgtSfHUBbx4EajU+vIZMFk18McPUcP:ddmgqCbCE/qkKV

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe
    "C:\Users\Admin\AppData\Local\Temp\7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za503785.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za503785.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za510957.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za510957.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\61280844.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\61280844.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32OK15.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32OK15.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4060
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1080
            5⤵
            • Program crash
            PID:1204
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xeeqk45.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xeeqk45.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4732
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            5⤵
            • Loads dropped DLL
            PID:3808
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys122856.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys122856.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1120
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1324
        3⤵
        • Program crash
        PID:4648
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4060 -ip 4060
    1⤵
      PID:4604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1120 -ip 1120
      1⤵
        PID:2916
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        1⤵
        • Executes dropped EXE
        PID:692
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:1400

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

        Filesize

        229KB

        MD5

        3308051ded87b1863a8d92925202c4b3

        SHA1

        7834ddc23e7976b07118fb580ae38234466dbdfb

        SHA256

        13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

        SHA512

        f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

        Filesize

        229KB

        MD5

        3308051ded87b1863a8d92925202c4b3

        SHA1

        7834ddc23e7976b07118fb580ae38234466dbdfb

        SHA256

        13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

        SHA512

        f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

        Filesize

        229KB

        MD5

        3308051ded87b1863a8d92925202c4b3

        SHA1

        7834ddc23e7976b07118fb580ae38234466dbdfb

        SHA256

        13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

        SHA512

        f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

        Filesize

        229KB

        MD5

        3308051ded87b1863a8d92925202c4b3

        SHA1

        7834ddc23e7976b07118fb580ae38234466dbdfb

        SHA256

        13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

        SHA512

        f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys122856.exe

        Filesize

        340KB

        MD5

        924ac742c1e0b0c533632d5906183691

        SHA1

        e9b4360552e93c60874502420eeff141449254d4

        SHA256

        864df00082b1fa645d09d92ef7e39e6100930ae74ffbd284d3be962a852f8d63

        SHA512

        52ced34574277f8d401558939f50977c2cd38d9124d38d6df5b39dd143b416157b30c8978e17d82ca054ab84f646a80369f619565255941f3be7f00d3f76ce1d

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys122856.exe

        Filesize

        340KB

        MD5

        924ac742c1e0b0c533632d5906183691

        SHA1

        e9b4360552e93c60874502420eeff141449254d4

        SHA256

        864df00082b1fa645d09d92ef7e39e6100930ae74ffbd284d3be962a852f8d63

        SHA512

        52ced34574277f8d401558939f50977c2cd38d9124d38d6df5b39dd143b416157b30c8978e17d82ca054ab84f646a80369f619565255941f3be7f00d3f76ce1d

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za503785.exe

        Filesize

        588KB

        MD5

        1ea84fc7060de6fc593002612e9d684e

        SHA1

        50cbd0f48c703dd999ff206cc3e8a856d4de9960

        SHA256

        baf4dd56f8d5d64487b367a78e18f06edfa3cbdd53bde70a7ab72880642ce4d2

        SHA512

        4f80eb844b86cc0fc4fdae0f0be69a127473dbc1d25f33b45d4b3a06dd41b176e1c554e67671a5b1669ddba8cfad9007991c2d3de7bc6e5c8e4aa8e37c7b37a5

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za503785.exe

        Filesize

        588KB

        MD5

        1ea84fc7060de6fc593002612e9d684e

        SHA1

        50cbd0f48c703dd999ff206cc3e8a856d4de9960

        SHA256

        baf4dd56f8d5d64487b367a78e18f06edfa3cbdd53bde70a7ab72880642ce4d2

        SHA512

        4f80eb844b86cc0fc4fdae0f0be69a127473dbc1d25f33b45d4b3a06dd41b176e1c554e67671a5b1669ddba8cfad9007991c2d3de7bc6e5c8e4aa8e37c7b37a5

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xeeqk45.exe

        Filesize

        229KB

        MD5

        3308051ded87b1863a8d92925202c4b3

        SHA1

        7834ddc23e7976b07118fb580ae38234466dbdfb

        SHA256

        13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

        SHA512

        f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xeeqk45.exe

        Filesize

        229KB

        MD5

        3308051ded87b1863a8d92925202c4b3

        SHA1

        7834ddc23e7976b07118fb580ae38234466dbdfb

        SHA256

        13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

        SHA512

        f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za510957.exe

        Filesize

        405KB

        MD5

        770cf775b3a8bccae79e2a612ba0419b

        SHA1

        a517e2388a08ea6f6b4dfd7b753350655f0fa51a

        SHA256

        107a9a962ba91d1fb20a03adf4dccebb60d7f6318385393b0ce000318b2125a2

        SHA512

        44f66759aba930ef0a574577a6227494de3083e7bb71400bfb988fe92226ef9848b36eadf7e8768c0a673394d91ffa6a457c1be4caec00e1300dc9f06007f64d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za510957.exe

        Filesize

        405KB

        MD5

        770cf775b3a8bccae79e2a612ba0419b

        SHA1

        a517e2388a08ea6f6b4dfd7b753350655f0fa51a

        SHA256

        107a9a962ba91d1fb20a03adf4dccebb60d7f6318385393b0ce000318b2125a2

        SHA512

        44f66759aba930ef0a574577a6227494de3083e7bb71400bfb988fe92226ef9848b36eadf7e8768c0a673394d91ffa6a457c1be4caec00e1300dc9f06007f64d

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\61280844.exe

        Filesize

        176KB

        MD5

        2b71f4b18ac8214a2bff547b6ce2f64f

        SHA1

        b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

        SHA256

        f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

        SHA512

        33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\61280844.exe

        Filesize

        176KB

        MD5

        2b71f4b18ac8214a2bff547b6ce2f64f

        SHA1

        b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

        SHA256

        f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

        SHA512

        33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32OK15.exe

        Filesize

        258KB

        MD5

        a7dfcff7874309cbec4b225e948a6540

        SHA1

        2b4270d06402a14da601b2e5f95e4349d956da5e

        SHA256

        d0673da5657a750c69d1dd0f56495ae6401f44353ec054b3d2868674c2b19b6a

        SHA512

        40ac7c5b747cf2344f16d2e84832e42436e270a59a88d950407633fad6b786294746955a54f01eb2fa4825b8f87ba8a023abf4cedb14badf3eaba19e185a5f52

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32OK15.exe

        Filesize

        258KB

        MD5

        a7dfcff7874309cbec4b225e948a6540

        SHA1

        2b4270d06402a14da601b2e5f95e4349d956da5e

        SHA256

        d0673da5657a750c69d1dd0f56495ae6401f44353ec054b3d2868674c2b19b6a

        SHA512

        40ac7c5b747cf2344f16d2e84832e42436e270a59a88d950407633fad6b786294746955a54f01eb2fa4825b8f87ba8a023abf4cedb14badf3eaba19e185a5f52

      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

        Filesize

        89KB

        MD5

        73df88d68a4f5e066784d462788cf695

        SHA1

        e4bfed336848d0b622fa464d40cf4bd9222aab3f

        SHA256

        f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

        SHA512

        64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

        Filesize

        89KB

        MD5

        73df88d68a4f5e066784d462788cf695

        SHA1

        e4bfed336848d0b622fa464d40cf4bd9222aab3f

        SHA256

        f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

        SHA512

        64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

        Filesize

        89KB

        MD5

        73df88d68a4f5e066784d462788cf695

        SHA1

        e4bfed336848d0b622fa464d40cf4bd9222aab3f

        SHA256

        f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

        SHA512

        64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

        Filesize

        162B

        MD5

        1b7c22a214949975556626d7217e9a39

        SHA1

        d01c97e2944166ed23e47e4a62ff471ab8fa031f

        SHA256

        340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

        SHA512

        ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

      • memory/1120-1049-0x000000000A740000-0x000000000A7A6000-memory.dmp

        Filesize

        408KB

      • memory/1120-1046-0x000000000A320000-0x000000000A42A000-memory.dmp

        Filesize

        1.0MB

      • memory/1120-1045-0x000000000A300000-0x000000000A312000-memory.dmp

        Filesize

        72KB

      • memory/1120-1044-0x0000000009C40000-0x000000000A258000-memory.dmp

        Filesize

        6.1MB

      • memory/1120-746-0x00000000071B0000-0x00000000071C0000-memory.dmp

        Filesize

        64KB

      • memory/1120-256-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1120-254-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1120-252-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1120-1047-0x000000000A440000-0x000000000A47C000-memory.dmp

        Filesize

        240KB

      • memory/1120-1048-0x00000000071B0000-0x00000000071C0000-memory.dmp

        Filesize

        64KB

      • memory/1120-251-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1120-250-0x00000000071B0000-0x00000000071C0000-memory.dmp

        Filesize

        64KB

      • memory/1120-249-0x0000000002CC0000-0x0000000002D06000-memory.dmp

        Filesize

        280KB

      • memory/1120-1050-0x000000000AE00000-0x000000000AE92000-memory.dmp

        Filesize

        584KB

      • memory/1120-1051-0x000000000AEC0000-0x000000000AF10000-memory.dmp

        Filesize

        320KB

      • memory/1120-1052-0x000000000AF20000-0x000000000AF96000-memory.dmp

        Filesize

        472KB

      • memory/1120-1053-0x000000000B000000-0x000000000B1C2000-memory.dmp

        Filesize

        1.8MB

      • memory/1120-1054-0x000000000B1E0000-0x000000000B70C000-memory.dmp

        Filesize

        5.2MB

      • memory/1120-1055-0x000000000B810000-0x000000000B82E000-memory.dmp

        Filesize

        120KB

      • memory/2964-171-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-165-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-154-0x0000000004A50000-0x0000000004FF4000-memory.dmp

        Filesize

        5.6MB

      • memory/2964-155-0x0000000004A40000-0x0000000004A50000-memory.dmp

        Filesize

        64KB

      • memory/2964-156-0x0000000004A40000-0x0000000004A50000-memory.dmp

        Filesize

        64KB

      • memory/2964-158-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-157-0x0000000004A40000-0x0000000004A50000-memory.dmp

        Filesize

        64KB

      • memory/2964-159-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-161-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-163-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-188-0x0000000004A40000-0x0000000004A50000-memory.dmp

        Filesize

        64KB

      • memory/2964-187-0x0000000004A40000-0x0000000004A50000-memory.dmp

        Filesize

        64KB

      • memory/2964-186-0x0000000004A40000-0x0000000004A50000-memory.dmp

        Filesize

        64KB

      • memory/2964-185-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-183-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-181-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-179-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-177-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-175-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-173-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-167-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/2964-169-0x0000000004950000-0x0000000004963000-memory.dmp

        Filesize

        76KB

      • memory/4060-231-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/4060-222-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

        Filesize

        180KB

      • memory/4060-223-0x00000000072F0000-0x0000000007300000-memory.dmp

        Filesize

        64KB

      • memory/4060-224-0x00000000072F0000-0x0000000007300000-memory.dmp

        Filesize

        64KB

      • memory/4060-225-0x00000000072F0000-0x0000000007300000-memory.dmp

        Filesize

        64KB

      • memory/4060-226-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/4060-228-0x00000000072F0000-0x0000000007300000-memory.dmp

        Filesize

        64KB

      • memory/4060-229-0x00000000072F0000-0x0000000007300000-memory.dmp

        Filesize

        64KB

      • memory/4060-230-0x00000000072F0000-0x0000000007300000-memory.dmp

        Filesize

        64KB