Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    141s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/04/2023, 05:45

General

  • Target

    370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4.exe

  • Size

    1.2MB

  • MD5

    a488220463f26523fa8765aa57390582

  • SHA1

    e53f8b82f31580dc20141784ee4e14608a03aac4

  • SHA256

    370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4

  • SHA512

    65baf891d73c99744e405fad2474ba40f786763e63fc2884a07e3308d74c2a2c215cdaeec8ae287c561971b3ee56d86ff90194f8838785cd50b27631d8fac85a

  • SSDEEP

    24576:SyMTSLrpx+3pP7oTBGTwmp61OnA04WFblVvtkM53qBgk0ppv1YT4jSZw8P:50Qs7uG8m61sA7WvgwwbSpvK42Zw8

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4.exe
    "C:\Users\Admin\AppData\Local\Temp\370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za466389.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za466389.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za232032.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za232032.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za796461.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za796461.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3428
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3176.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3176.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2960
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7282Ng.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7282Ng.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:68
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00HC79.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00HC79.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2492
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTLNg88.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTLNg88.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02jq74.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02jq74.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:1188
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          4⤵
          • Loads dropped DLL
          PID:2244
  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:2464

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02jq74.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y02jq74.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za466389.exe

    Filesize

    1.1MB

    MD5

    5ecc1c0f64b8d68bb21b59bfb2b5e37c

    SHA1

    0f4913141baf6c31f5cbebe944e243334bf47e72

    SHA256

    4ea64d37c04a0ace35c2398f2d210b84a15affffecb529347b8e6775a3731b41

    SHA512

    9c1cb9fd9dca0d01baeb4f4ad8dad17fb84333d71ddd9475ad13cf9a922e348ed2efa132b41b3476faaaad2a2d04a96f71c512c9fb48c33e67c3cde9693a741e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za466389.exe

    Filesize

    1.1MB

    MD5

    5ecc1c0f64b8d68bb21b59bfb2b5e37c

    SHA1

    0f4913141baf6c31f5cbebe944e243334bf47e72

    SHA256

    4ea64d37c04a0ace35c2398f2d210b84a15affffecb529347b8e6775a3731b41

    SHA512

    9c1cb9fd9dca0d01baeb4f4ad8dad17fb84333d71ddd9475ad13cf9a922e348ed2efa132b41b3476faaaad2a2d04a96f71c512c9fb48c33e67c3cde9693a741e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTLNg88.exe

    Filesize

    485KB

    MD5

    f5673d59639a528e4a6215b45d99aeb7

    SHA1

    cbb0f1133f2fa70b9eb951982d07445bbe13a3b0

    SHA256

    5f51cfcaa10e8afb7fb50a32bd1c2742f516113d20cdeea6c5a16a28feca9f56

    SHA512

    4d2194f823afb418d9b1028c8d88f1239029559ad33baadc3a118fdf050c15c8930c22d07e096c88c35692b8e02f9bc327c7f5839167eb23cc3c6905e927e455

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTLNg88.exe

    Filesize

    485KB

    MD5

    f5673d59639a528e4a6215b45d99aeb7

    SHA1

    cbb0f1133f2fa70b9eb951982d07445bbe13a3b0

    SHA256

    5f51cfcaa10e8afb7fb50a32bd1c2742f516113d20cdeea6c5a16a28feca9f56

    SHA512

    4d2194f823afb418d9b1028c8d88f1239029559ad33baadc3a118fdf050c15c8930c22d07e096c88c35692b8e02f9bc327c7f5839167eb23cc3c6905e927e455

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za232032.exe

    Filesize

    804KB

    MD5

    78e9e9d7675d53cccab226be6aad6ac4

    SHA1

    7bbe882480373d28b36903fba1d3077c6b11df60

    SHA256

    2837d391f235f1c4a6f63e7abbdeb29ff144e82c12ea6a8a1e521362f1dc2c98

    SHA512

    ccd8b0251cb2ff8579b22da95242b2c1fe1f571a3b7e9691a9afe04fffd22d1248386379e723dbb9b805095e163e0e269a1601e7b2ec624343bf9310549c7bb3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za232032.exe

    Filesize

    804KB

    MD5

    78e9e9d7675d53cccab226be6aad6ac4

    SHA1

    7bbe882480373d28b36903fba1d3077c6b11df60

    SHA256

    2837d391f235f1c4a6f63e7abbdeb29ff144e82c12ea6a8a1e521362f1dc2c98

    SHA512

    ccd8b0251cb2ff8579b22da95242b2c1fe1f571a3b7e9691a9afe04fffd22d1248386379e723dbb9b805095e163e0e269a1601e7b2ec624343bf9310549c7bb3

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00HC79.exe

    Filesize

    403KB

    MD5

    97e8d91aa29d62686d48d3729ddb2894

    SHA1

    2d44bb21861f2e3f3a86183165eb7ae7f5878d3e

    SHA256

    f47b71bed8393497deeb8c8940952d77ee5692c0b4b3ae449113d7961148c602

    SHA512

    d658113d1d464531fab2291f004a10f2b34210c3ad9e8529938eb8cd68551bdd45803f677950ef4a9709732d3f18be49a1197b11c1c3a568992574bfaefec05c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w00HC79.exe

    Filesize

    403KB

    MD5

    97e8d91aa29d62686d48d3729ddb2894

    SHA1

    2d44bb21861f2e3f3a86183165eb7ae7f5878d3e

    SHA256

    f47b71bed8393497deeb8c8940952d77ee5692c0b4b3ae449113d7961148c602

    SHA512

    d658113d1d464531fab2291f004a10f2b34210c3ad9e8529938eb8cd68551bdd45803f677950ef4a9709732d3f18be49a1197b11c1c3a568992574bfaefec05c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za796461.exe

    Filesize

    469KB

    MD5

    263db4039699faee60824d23af98d516

    SHA1

    9ffdd319d00a6b40dfec85f6a6687d757f93aff1

    SHA256

    e960624810ef846cd4e1f3d0cd219629243acb1faaf1c1797906fda2e69736f8

    SHA512

    684cf5e7456457ed286559606b845c3862273ec447851a5c39492055cd9269160b23a31b5df6e885dae5d5539acc8e62cb4ee364913f0afe3726ffcac02a9c65

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za796461.exe

    Filesize

    469KB

    MD5

    263db4039699faee60824d23af98d516

    SHA1

    9ffdd319d00a6b40dfec85f6a6687d757f93aff1

    SHA256

    e960624810ef846cd4e1f3d0cd219629243acb1faaf1c1797906fda2e69736f8

    SHA512

    684cf5e7456457ed286559606b845c3862273ec447851a5c39492055cd9269160b23a31b5df6e885dae5d5539acc8e62cb4ee364913f0afe3726ffcac02a9c65

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3176.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3176.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7282Ng.exe

    Filesize

    485KB

    MD5

    b3d983ecbf3e0e3014c4a14153a20b1f

    SHA1

    ac0176589110422711418c87353f6680b5fd4117

    SHA256

    96f3b6ac1a2029308b59f943fdd5e3767f06b2bf5fab068ffc39ac7361da403e

    SHA512

    d98729095310d92c107c735628c8998369f15fe580580f535aa428b695762dbe6e48232efcea09010ec3156d7106cef0fae45ba3f2a5b4c53069403af4b79596

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7282Ng.exe

    Filesize

    485KB

    MD5

    b3d983ecbf3e0e3014c4a14153a20b1f

    SHA1

    ac0176589110422711418c87353f6680b5fd4117

    SHA256

    96f3b6ac1a2029308b59f943fdd5e3767f06b2bf5fab068ffc39ac7361da403e

    SHA512

    d98729095310d92c107c735628c8998369f15fe580580f535aa428b695762dbe6e48232efcea09010ec3156d7106cef0fae45ba3f2a5b4c53069403af4b79596

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • memory/68-169-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-960-0x00000000082C0000-0x0000000008326000-memory.dmp

    Filesize

    408KB

  • memory/68-171-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-179-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-183-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-181-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-185-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-189-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-187-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-193-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-195-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-191-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-199-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-197-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-201-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-203-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-205-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-211-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-209-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-207-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-221-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-225-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-223-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-219-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-217-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-215-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-213-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-954-0x0000000007810000-0x0000000007E16000-memory.dmp

    Filesize

    6.0MB

  • memory/68-955-0x0000000007E60000-0x0000000007E72000-memory.dmp

    Filesize

    72KB

  • memory/68-956-0x0000000007E90000-0x0000000007F9A000-memory.dmp

    Filesize

    1.0MB

  • memory/68-957-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/68-958-0x0000000007FB0000-0x0000000007FEE000-memory.dmp

    Filesize

    248KB

  • memory/68-959-0x0000000008030000-0x000000000807B000-memory.dmp

    Filesize

    300KB

  • memory/68-177-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-961-0x0000000008970000-0x0000000008A02000-memory.dmp

    Filesize

    584KB

  • memory/68-962-0x0000000008A40000-0x0000000008AB6000-memory.dmp

    Filesize

    472KB

  • memory/68-963-0x0000000008B10000-0x0000000008CD2000-memory.dmp

    Filesize

    1.8MB

  • memory/68-964-0x0000000008CE0000-0x000000000920C000-memory.dmp

    Filesize

    5.2MB

  • memory/68-965-0x0000000009340000-0x000000000935E000-memory.dmp

    Filesize

    120KB

  • memory/68-967-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/68-968-0x00000000024F0000-0x0000000002540000-memory.dmp

    Filesize

    320KB

  • memory/68-173-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-175-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-155-0x00000000008F0000-0x0000000000936000-memory.dmp

    Filesize

    280KB

  • memory/68-156-0x0000000004D50000-0x0000000004D8C000-memory.dmp

    Filesize

    240KB

  • memory/68-157-0x0000000004E10000-0x000000000530E000-memory.dmp

    Filesize

    5.0MB

  • memory/68-158-0x0000000005310000-0x000000000534A000-memory.dmp

    Filesize

    232KB

  • memory/68-160-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/68-159-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/68-167-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-165-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-161-0x0000000004E00000-0x0000000004E10000-memory.dmp

    Filesize

    64KB

  • memory/68-162-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/68-163-0x0000000005310000-0x0000000005345000-memory.dmp

    Filesize

    212KB

  • memory/2492-1008-0x0000000004D50000-0x0000000004D60000-memory.dmp

    Filesize

    64KB

  • memory/2492-1007-0x0000000004D50000-0x0000000004D60000-memory.dmp

    Filesize

    64KB

  • memory/2492-1006-0x0000000004D50000-0x0000000004D60000-memory.dmp

    Filesize

    64KB

  • memory/2492-1005-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/2492-976-0x00000000023F0000-0x0000000002408000-memory.dmp

    Filesize

    96KB

  • memory/2492-975-0x0000000000A30000-0x0000000000A4A000-memory.dmp

    Filesize

    104KB

  • memory/2804-1811-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/2804-1300-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/2804-1296-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/2804-1298-0x0000000004F70000-0x0000000004F80000-memory.dmp

    Filesize

    64KB

  • memory/2960-149-0x0000000000C40000-0x0000000000C4A000-memory.dmp

    Filesize

    40KB