Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/04/2023, 19:41

General

  • Target

    72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe

  • Size

    1.0MB

  • MD5

    1180fb9ee6f43ea57e520084d89822a6

  • SHA1

    0e6315f82abd127853851374931f2ab8f2196511

  • SHA256

    72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d

  • SHA512

    cc060fbe451a37b10447596497c44857aa69e657bf35dcda7f88e36e4f488c135abb67566877fa61bd03ba0449a44ce7ab626b15f653acb960eeb582c6151cc7

  • SSDEEP

    24576:+yW0Rg9IeHlRrP+wdYWy+X0lhZgmWZwtX:N2HlTdjyGgZDz

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe
    "C:\Users\Admin\AppData\Local\Temp\72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za547358.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za547358.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za127015.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za127015.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\39520144.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\39520144.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4008
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w78eE51.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w78eE51.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1084
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xvEoS86.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xvEoS86.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3924
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            5⤵
            • Loads dropped DLL
            PID:5020
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys508003.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys508003.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4172
  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:4620
  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:5048

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys508003.exe

    Filesize

    459KB

    MD5

    c97e22ae4aac3dd93fd653f498991773

    SHA1

    8d7bf0a28bbd28a74e9f3454af587af6f669548f

    SHA256

    01fbaf34e6e98be9ea2f535a481d2b3fbc52ca6dbe2f35d2db92e95f06481b7e

    SHA512

    a3d8fdeaf2985e5b5fab0f6da63c227f388907f52d9059d8ce6b33d69eb12fae04e2dc0c661da9ed2634e09bc9efbb10a65e1f7b4ca8d0c8e4bf0c2ab6aff3ef

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys508003.exe

    Filesize

    459KB

    MD5

    c97e22ae4aac3dd93fd653f498991773

    SHA1

    8d7bf0a28bbd28a74e9f3454af587af6f669548f

    SHA256

    01fbaf34e6e98be9ea2f535a481d2b3fbc52ca6dbe2f35d2db92e95f06481b7e

    SHA512

    a3d8fdeaf2985e5b5fab0f6da63c227f388907f52d9059d8ce6b33d69eb12fae04e2dc0c661da9ed2634e09bc9efbb10a65e1f7b4ca8d0c8e4bf0c2ab6aff3ef

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za547358.exe

    Filesize

    775KB

    MD5

    2e79e4fd2bb1ed837642e1846f408885

    SHA1

    95d9321c0597999103c217fef06a3debb274ca6c

    SHA256

    dbe9eb72e2e8cc3be9ffd9162dcef9d80a0152f1e3a8dae480a4138ca84ab7b6

    SHA512

    a656e37814efe171fa5033876cbfec92d0d167f7cb43b06b77aeceba7083e88116141c3505c1b3f918008b9fb4ac8a9abab807918d71795aec8c6c107c5cd871

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za547358.exe

    Filesize

    775KB

    MD5

    2e79e4fd2bb1ed837642e1846f408885

    SHA1

    95d9321c0597999103c217fef06a3debb274ca6c

    SHA256

    dbe9eb72e2e8cc3be9ffd9162dcef9d80a0152f1e3a8dae480a4138ca84ab7b6

    SHA512

    a656e37814efe171fa5033876cbfec92d0d167f7cb43b06b77aeceba7083e88116141c3505c1b3f918008b9fb4ac8a9abab807918d71795aec8c6c107c5cd871

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xvEoS86.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xvEoS86.exe

    Filesize

    229KB

    MD5

    3308051ded87b1863a8d92925202c4b3

    SHA1

    7834ddc23e7976b07118fb580ae38234466dbdfb

    SHA256

    13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

    SHA512

    f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za127015.exe

    Filesize

    592KB

    MD5

    78e5ff43d54ed7bab77679a657f63c90

    SHA1

    40f0adc201e3717f75767b9d21f4055fad147e50

    SHA256

    d0acf83fea2c576f87aafd9aa6952825d85e5343702452bb57e3dc1fca887028

    SHA512

    572a61ed7f69a008d9d29e92b36dbf4f1b1779c83a98f6f4d7d27632b2d48102e56a5dc354f27dffb284a35b3b469be2a405a71cf5c4980f436faecfc1e26093

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za127015.exe

    Filesize

    592KB

    MD5

    78e5ff43d54ed7bab77679a657f63c90

    SHA1

    40f0adc201e3717f75767b9d21f4055fad147e50

    SHA256

    d0acf83fea2c576f87aafd9aa6952825d85e5343702452bb57e3dc1fca887028

    SHA512

    572a61ed7f69a008d9d29e92b36dbf4f1b1779c83a98f6f4d7d27632b2d48102e56a5dc354f27dffb284a35b3b469be2a405a71cf5c4980f436faecfc1e26093

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\39520144.exe

    Filesize

    377KB

    MD5

    77ca67247d7a272a8c428d694c971bce

    SHA1

    29cbb73128b07804e0b681acbe4dccb39deea724

    SHA256

    e1c89680e5c7104d024c79089091e5f1c56c66163a54472566d7689dd72e3bf7

    SHA512

    03350e0ae99518aa81775d774450239bb197abf09e2f9f4ec2393e8a0fe82a77ba57765b0cb3e268e62b5bc77cb72328a20242b7bef5c83a25374f2ee0126c5a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\39520144.exe

    Filesize

    377KB

    MD5

    77ca67247d7a272a8c428d694c971bce

    SHA1

    29cbb73128b07804e0b681acbe4dccb39deea724

    SHA256

    e1c89680e5c7104d024c79089091e5f1c56c66163a54472566d7689dd72e3bf7

    SHA512

    03350e0ae99518aa81775d774450239bb197abf09e2f9f4ec2393e8a0fe82a77ba57765b0cb3e268e62b5bc77cb72328a20242b7bef5c83a25374f2ee0126c5a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w78eE51.exe

    Filesize

    459KB

    MD5

    7a98ec8bc733ca4165af061677ac5752

    SHA1

    821c5578208209a9b4210442b97592fdcd7ae0ad

    SHA256

    8453f0c8fe2a1df025250d237b80302f7fd9406cc6030a892c61d2880b1717c7

    SHA512

    93768429cbccd9dca02c07e3c7acfd5cb84bfd0be21dae278ae1aa5ca57cf0970fc58e051cf1472cbc02e6ee3b61f50492f8cedc1a1bbb98a7969fea4bcbc29c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w78eE51.exe

    Filesize

    459KB

    MD5

    7a98ec8bc733ca4165af061677ac5752

    SHA1

    821c5578208209a9b4210442b97592fdcd7ae0ad

    SHA256

    8453f0c8fe2a1df025250d237b80302f7fd9406cc6030a892c61d2880b1717c7

    SHA512

    93768429cbccd9dca02c07e3c7acfd5cb84bfd0be21dae278ae1aa5ca57cf0970fc58e051cf1472cbc02e6ee3b61f50492f8cedc1a1bbb98a7969fea4bcbc29c

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • memory/1084-992-0x0000000008A90000-0x0000000008B06000-memory.dmp

    Filesize

    472KB

  • memory/1084-220-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-995-0x0000000008ED0000-0x00000000093FC000-memory.dmp

    Filesize

    5.2MB

  • memory/1084-994-0x0000000008CF0000-0x0000000008EB2000-memory.dmp

    Filesize

    1.8MB

  • memory/1084-993-0x0000000008B40000-0x0000000008B5E000-memory.dmp

    Filesize

    120KB

  • memory/1084-991-0x0000000008A20000-0x0000000008A70000-memory.dmp

    Filesize

    320KB

  • memory/1084-990-0x0000000008980000-0x0000000008A12000-memory.dmp

    Filesize

    584KB

  • memory/1084-989-0x0000000007CB0000-0x0000000007D16000-memory.dmp

    Filesize

    408KB

  • memory/1084-988-0x0000000007A20000-0x0000000007A6B000-memory.dmp

    Filesize

    300KB

  • memory/1084-987-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

  • memory/1084-986-0x00000000079A0000-0x00000000079DE000-memory.dmp

    Filesize

    248KB

  • memory/1084-985-0x0000000007880000-0x000000000798A000-memory.dmp

    Filesize

    1.0MB

  • memory/1084-185-0x00000000025B0000-0x00000000025EC000-memory.dmp

    Filesize

    240KB

  • memory/1084-188-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

  • memory/1084-187-0x00000000008F0000-0x0000000000936000-memory.dmp

    Filesize

    280KB

  • memory/1084-190-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-192-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

  • memory/1084-194-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-191-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-189-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

  • memory/1084-186-0x0000000004CE0000-0x0000000004D1A000-memory.dmp

    Filesize

    232KB

  • memory/1084-196-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-200-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-198-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-202-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-204-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-206-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-208-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-210-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-212-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-214-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-216-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-218-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-984-0x0000000007860000-0x0000000007872000-memory.dmp

    Filesize

    72KB

  • memory/1084-222-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-224-0x0000000004CE0000-0x0000000004D15000-memory.dmp

    Filesize

    212KB

  • memory/1084-983-0x0000000007E30000-0x0000000008436000-memory.dmp

    Filesize

    6.0MB

  • memory/4008-159-0x0000000002300000-0x0000000002310000-memory.dmp

    Filesize

    64KB

  • memory/4008-153-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/4008-164-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-180-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/4008-179-0x0000000002300000-0x0000000002310000-memory.dmp

    Filesize

    64KB

  • memory/4008-177-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/4008-176-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-174-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-155-0x0000000002300000-0x0000000002310000-memory.dmp

    Filesize

    64KB

  • memory/4008-172-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-170-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-168-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-156-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-160-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-162-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-142-0x00000000024A0000-0x00000000024BA000-memory.dmp

    Filesize

    104KB

  • memory/4008-143-0x0000000004D60000-0x000000000525E000-memory.dmp

    Filesize

    5.0MB

  • memory/4008-152-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-150-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-144-0x0000000005260000-0x0000000005278000-memory.dmp

    Filesize

    96KB

  • memory/4008-157-0x0000000002300000-0x0000000002310000-memory.dmp

    Filesize

    64KB

  • memory/4008-145-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-166-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-146-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4008-148-0x0000000005260000-0x0000000005272000-memory.dmp

    Filesize

    72KB

  • memory/4172-1808-0x0000000005230000-0x0000000005240000-memory.dmp

    Filesize

    64KB

  • memory/4172-1031-0x0000000005230000-0x0000000005240000-memory.dmp

    Filesize

    64KB

  • memory/4172-1027-0x0000000005230000-0x0000000005240000-memory.dmp

    Filesize

    64KB

  • memory/4172-1807-0x0000000002930000-0x000000000297B000-memory.dmp

    Filesize

    300KB

  • memory/4172-1029-0x0000000005230000-0x0000000005240000-memory.dmp

    Filesize

    64KB