Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/04/2023, 16:30

General

  • Target

    57d827a0d63bc6cf92cd0db57cf8799cdd7497b3735574fec37f2e5c457a0700.exe

  • Size

    1.1MB

  • MD5

    3a3bbbb9b52b66dfedf89ed307a356bc

  • SHA1

    b11636db74bf7fb9873222968f25b9ce8d5be3b9

  • SHA256

    57d827a0d63bc6cf92cd0db57cf8799cdd7497b3735574fec37f2e5c457a0700

  • SHA512

    70464f302116f7933cfc2f09ccf13af5f97834439c88151af4bb6828a677d5b502e0ff0b5a3a1eb99dd50f6c8f60e6cbb89c76ffd929ce02a634c87e051ca0cb

  • SSDEEP

    24576:2yRTzIvwCVtjLMD5TXKsvRHJHZaQF+irr7zq55:FRPafLMD5ThLHZak/S

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57d827a0d63bc6cf92cd0db57cf8799cdd7497b3735574fec37f2e5c457a0700.exe
    "C:\Users\Admin\AppData\Local\Temp\57d827a0d63bc6cf92cd0db57cf8799cdd7497b3735574fec37f2e5c457a0700.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za037618.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za037618.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za171050.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za171050.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za557580.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za557580.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1854.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1854.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3940
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2296Gt.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2296Gt.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1436
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w31mN44.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w31mN44.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2568
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJVTj48.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJVTj48.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2404
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86te84.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86te84.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3892
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          4⤵
          • Loads dropped DLL
          PID:4956
  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:2216
  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:1096

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86te84.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y86te84.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za037618.exe

    Filesize

    917KB

    MD5

    c978474c78050af86b4133b998293b0c

    SHA1

    7ad0b5961cd3e582855640c79f19786e5df11197

    SHA256

    d0c5a4faa239f24b11d2f9e3d5dd2da0c2b72caab13bc4ac9e4be5f4a641e345

    SHA512

    c264dcdca27b6a34a058c13b4c944b32b468752172c050dbde87801a655480d481b72c23c953b696a760ce7fc34a4f744fbf699c0d49a002168783f6b48cd77d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za037618.exe

    Filesize

    917KB

    MD5

    c978474c78050af86b4133b998293b0c

    SHA1

    7ad0b5961cd3e582855640c79f19786e5df11197

    SHA256

    d0c5a4faa239f24b11d2f9e3d5dd2da0c2b72caab13bc4ac9e4be5f4a641e345

    SHA512

    c264dcdca27b6a34a058c13b4c944b32b468752172c050dbde87801a655480d481b72c23c953b696a760ce7fc34a4f744fbf699c0d49a002168783f6b48cd77d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJVTj48.exe

    Filesize

    359KB

    MD5

    5797d37c8cf8bd9dd527af15efc7e78c

    SHA1

    dd5d913cc599469c53a93795aec5d66365317bf9

    SHA256

    58e750eb51761d2c00d6e8e45deec99fc1568dddc1961de7ada2335d360d57e4

    SHA512

    b88d960ca24aefc0ee9bb0d1e74708b5deeb228e8daec6365825e7d9fcd27657966262bb67bc4f07e2fdcbce5a726bc7ff1f29fc2ac041818d9205b2c4aa06d8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJVTj48.exe

    Filesize

    359KB

    MD5

    5797d37c8cf8bd9dd527af15efc7e78c

    SHA1

    dd5d913cc599469c53a93795aec5d66365317bf9

    SHA256

    58e750eb51761d2c00d6e8e45deec99fc1568dddc1961de7ada2335d360d57e4

    SHA512

    b88d960ca24aefc0ee9bb0d1e74708b5deeb228e8daec6365825e7d9fcd27657966262bb67bc4f07e2fdcbce5a726bc7ff1f29fc2ac041818d9205b2c4aa06d8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za171050.exe

    Filesize

    694KB

    MD5

    c392036c8b0d42f1b1f5d3e17cf0a304

    SHA1

    f79868deb5f3474926a5f71d92cb5c917cc53f41

    SHA256

    05d37eff810fc2119bf41c56dfec5b218929c6f7c047f7c26fc1f906f940332c

    SHA512

    6bd8cbc536f5e5f1669051e4325c3937aa07e74c3f07be5d7f794586046ed82db9ff8cda4a85b547abc8491e340527bcf3f8db4011a0b407f21cc5f8880c4538

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za171050.exe

    Filesize

    694KB

    MD5

    c392036c8b0d42f1b1f5d3e17cf0a304

    SHA1

    f79868deb5f3474926a5f71d92cb5c917cc53f41

    SHA256

    05d37eff810fc2119bf41c56dfec5b218929c6f7c047f7c26fc1f906f940332c

    SHA512

    6bd8cbc536f5e5f1669051e4325c3937aa07e74c3f07be5d7f794586046ed82db9ff8cda4a85b547abc8491e340527bcf3f8db4011a0b407f21cc5f8880c4538

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w31mN44.exe

    Filesize

    277KB

    MD5

    52898a6fcbb765b437e8472e929007e6

    SHA1

    aaa76a88fd6e77d212addbd1fe4dd58c2a1a1a9b

    SHA256

    94c928e9397303f45aea02cbea0ca552b5a29b149fa351d7c5fb85c7ce96c052

    SHA512

    7141939229981a4594405e12383b4dfec2bc55ca9f93bca3b940b07995db705f78af1d767fc5c9712c8127b9cda164de86b0367ed2c83f9404fee36480f2af93

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w31mN44.exe

    Filesize

    277KB

    MD5

    52898a6fcbb765b437e8472e929007e6

    SHA1

    aaa76a88fd6e77d212addbd1fe4dd58c2a1a1a9b

    SHA256

    94c928e9397303f45aea02cbea0ca552b5a29b149fa351d7c5fb85c7ce96c052

    SHA512

    7141939229981a4594405e12383b4dfec2bc55ca9f93bca3b940b07995db705f78af1d767fc5c9712c8127b9cda164de86b0367ed2c83f9404fee36480f2af93

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za557580.exe

    Filesize

    414KB

    MD5

    6b5836c8c5f310a6f1960415be4c89da

    SHA1

    e0ab0ba143a8da3d5500a6866d3bd2454f01bf16

    SHA256

    b0f8759fb1e864ab252f32951c580bdca2a683957256a981e53ee26e978ae2e7

    SHA512

    9972070f7b5223c7f7287693e15cf6d2ed6ebdd8fc3e58b211da40de2eef11d5209cf85586c0eeee90d78898e4fa75b85de9bdc390e0023b7296b90004c41dea

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za557580.exe

    Filesize

    414KB

    MD5

    6b5836c8c5f310a6f1960415be4c89da

    SHA1

    e0ab0ba143a8da3d5500a6866d3bd2454f01bf16

    SHA256

    b0f8759fb1e864ab252f32951c580bdca2a683957256a981e53ee26e978ae2e7

    SHA512

    9972070f7b5223c7f7287693e15cf6d2ed6ebdd8fc3e58b211da40de2eef11d5209cf85586c0eeee90d78898e4fa75b85de9bdc390e0023b7296b90004c41dea

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1854.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1854.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2296Gt.exe

    Filesize

    359KB

    MD5

    760260cf2a9b33fb41c398dca448a65e

    SHA1

    b6aadd99e481a18d2a8ea630ea3f7333b3cdc8b3

    SHA256

    ba8208ad6475a1056130578fb83f3302fc6a101f5cf8fa50a09e03d36a91ed84

    SHA512

    0bfbf15185ac564a4e15de0a7b7d7a4198d72071acb25d25ce54f44d081cf6cfc9ffe9888a5f43ace55aacb6ce058a9d8acf9b0736976c1f7f2b16d8084bb600

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2296Gt.exe

    Filesize

    359KB

    MD5

    760260cf2a9b33fb41c398dca448a65e

    SHA1

    b6aadd99e481a18d2a8ea630ea3f7333b3cdc8b3

    SHA256

    ba8208ad6475a1056130578fb83f3302fc6a101f5cf8fa50a09e03d36a91ed84

    SHA512

    0bfbf15185ac564a4e15de0a7b7d7a4198d72071acb25d25ce54f44d081cf6cfc9ffe9888a5f43ace55aacb6ce058a9d8acf9b0736976c1f7f2b16d8084bb600

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • memory/1436-207-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-956-0x0000000009C20000-0x0000000009D2A000-memory.dmp

    Filesize

    1.0MB

  • memory/1436-173-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-175-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-177-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-179-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-181-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-183-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-185-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-187-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-189-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-191-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-193-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-195-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-197-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-199-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-201-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-203-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-205-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-169-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-209-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-211-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-213-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-215-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-217-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-219-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-221-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-223-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-225-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-954-0x000000000A170000-0x000000000A776000-memory.dmp

    Filesize

    6.0MB

  • memory/1436-955-0x0000000009BF0000-0x0000000009C02000-memory.dmp

    Filesize

    72KB

  • memory/1436-171-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-957-0x0000000009D40000-0x0000000009D7E000-memory.dmp

    Filesize

    248KB

  • memory/1436-958-0x0000000009DC0000-0x0000000009E0B000-memory.dmp

    Filesize

    300KB

  • memory/1436-959-0x0000000007110000-0x0000000007120000-memory.dmp

    Filesize

    64KB

  • memory/1436-960-0x000000000A050000-0x000000000A0B6000-memory.dmp

    Filesize

    408KB

  • memory/1436-961-0x000000000AD20000-0x000000000ADB2000-memory.dmp

    Filesize

    584KB

  • memory/1436-962-0x000000000AEC0000-0x000000000AF36000-memory.dmp

    Filesize

    472KB

  • memory/1436-963-0x000000000AF90000-0x000000000AFAE000-memory.dmp

    Filesize

    120KB

  • memory/1436-964-0x000000000B030000-0x000000000B080000-memory.dmp

    Filesize

    320KB

  • memory/1436-965-0x000000000B0A0000-0x000000000B262000-memory.dmp

    Filesize

    1.8MB

  • memory/1436-966-0x000000000B270000-0x000000000B79C000-memory.dmp

    Filesize

    5.2MB

  • memory/1436-155-0x00000000070C0000-0x00000000070FC000-memory.dmp

    Filesize

    240KB

  • memory/1436-156-0x0000000002CE0000-0x0000000002D26000-memory.dmp

    Filesize

    280KB

  • memory/1436-157-0x0000000007110000-0x0000000007120000-memory.dmp

    Filesize

    64KB

  • memory/1436-158-0x0000000007110000-0x0000000007120000-memory.dmp

    Filesize

    64KB

  • memory/1436-159-0x0000000007110000-0x0000000007120000-memory.dmp

    Filesize

    64KB

  • memory/1436-160-0x0000000007120000-0x000000000761E000-memory.dmp

    Filesize

    5.0MB

  • memory/1436-161-0x0000000007660000-0x000000000769A000-memory.dmp

    Filesize

    232KB

  • memory/1436-162-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-167-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-165-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/1436-163-0x0000000007660000-0x0000000007695000-memory.dmp

    Filesize

    212KB

  • memory/2404-1810-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2404-1109-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2404-1105-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2404-1107-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2568-1005-0x0000000007110000-0x0000000007120000-memory.dmp

    Filesize

    64KB

  • memory/2568-1004-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/2568-975-0x0000000004820000-0x0000000004838000-memory.dmp

    Filesize

    96KB

  • memory/2568-974-0x0000000002EF0000-0x0000000002F0A000-memory.dmp

    Filesize

    104KB

  • memory/2568-1006-0x0000000007110000-0x0000000007120000-memory.dmp

    Filesize

    64KB

  • memory/2568-1007-0x0000000007110000-0x0000000007120000-memory.dmp

    Filesize

    64KB

  • memory/3940-149-0x0000000000310000-0x000000000031A000-memory.dmp

    Filesize

    40KB