Behavioral Report

Analysis

max time kernel
107s
max time network
101s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
06-02-2023 19:48

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe
Size

558KB
MD5

0f0160c207e1bbfe44be146b432f7b75
SHA1

1212bdc7c23ca87d5de120dabf1f64454146b7b5
SHA256

840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84
SHA512

b19601e30b3950680080ed352cb0b235ab61e5dd26e411d39d05dd48ab2ccec7794ade8dd1a7bbca94c352f7690704460d86166d13667c1b91f0ad00d6b61f5b
SSDEEP

12288:iMrHy90lVqeCcVHgaN6bBUK6uYCvQTw53VpaRb+bVUKenp6dv:dyoVCcpMDHvoj66Y5

Score

10^/10

amadey evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.66

62.204.41.5/Bu58Ngs/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

TTPs:

Modify Registry Modify Existing Service Disabling Security Tools

Processes:

mika.exeaUMx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	mika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	mika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	aUMx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	aUMx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	aUMx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	mika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	aUMx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	aUMx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	mika.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	mika.exe

Executes dropped EXE 7 IoCs

Processes:

cUMn.exeaUMx.exemika.exevona.exemnolyk.exemnolyk.exemnolyk.exe

pid process

4036 cUMn.exe
2924 aUMx.exe
4268 mika.exe
3556 vona.exe
3336 mnolyk.exe
1716 mnolyk.exe
4268 mnolyk.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4840 rundll32.exe

pid	process
4036	cUMn.exe
2924	aUMx.exe
4268	mika.exe
3556	vona.exe
3336	mnolyk.exe
1716	mnolyk.exe
4268	mnolyk.exe

pid	process
4840	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

TTPs:

Disabling Security Tools Modify Registry

Processes:

mika.exeaUMx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	mika.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	aUMx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	aUMx.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

TTPs:

Registry Run Keys / Startup Folder Modify Registry

Processes:

cUMn.exe840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	cUMn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cUMn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

TTPs:

Scheduled Task

Processes:

schtasks.exe

pid process

1752 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

aUMx.exemika.exe

pid process

2924 aUMx.exe
2924 aUMx.exe
4268 mika.exe
4268 mika.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

aUMx.exemika.exe

description pid process

Token: SeDebugPrivilege 2924 aUMx.exe
Token: SeDebugPrivilege 4268 mika.exe

pid	process
1752	schtasks.exe

pid	process
2924	aUMx.exe
2924	aUMx.exe
4268	mika.exe
4268	mika.exe

description	pid	process
Token: SeDebugPrivilege	2924	aUMx.exe
Token: SeDebugPrivilege	4268	mika.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.execUMn.exevona.exemnolyk.execmd.exe

description	pid	process	target process
PID 2760 wrote to memory of 4036	2760	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe	cUMn.exe
PID 2760 wrote to memory of 4036	2760	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe	cUMn.exe
PID 2760 wrote to memory of 4036	2760	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe	cUMn.exe
PID 4036 wrote to memory of 2924	4036	cUMn.exe	aUMx.exe
PID 4036 wrote to memory of 2924	4036	cUMn.exe	aUMx.exe
PID 4036 wrote to memory of 2924	4036	cUMn.exe	aUMx.exe
PID 4036 wrote to memory of 4268	4036	cUMn.exe	mika.exe
PID 4036 wrote to memory of 4268	4036	cUMn.exe	mika.exe
PID 2760 wrote to memory of 3556	2760	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe	vona.exe
PID 2760 wrote to memory of 3556	2760	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe	vona.exe
PID 2760 wrote to memory of 3556	2760	840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe	vona.exe
PID 3556 wrote to memory of 3336	3556	vona.exe	mnolyk.exe
PID 3556 wrote to memory of 3336	3556	vona.exe	mnolyk.exe
PID 3556 wrote to memory of 3336	3556	vona.exe	mnolyk.exe
PID 3336 wrote to memory of 1752	3336	mnolyk.exe	schtasks.exe
PID 3336 wrote to memory of 1752	3336	mnolyk.exe	schtasks.exe
PID 3336 wrote to memory of 1752	3336	mnolyk.exe	schtasks.exe
PID 3336 wrote to memory of 524	3336	mnolyk.exe	cmd.exe
PID 3336 wrote to memory of 524	3336	mnolyk.exe	cmd.exe
PID 3336 wrote to memory of 524	3336	mnolyk.exe	cmd.exe
PID 524 wrote to memory of 2204	524	cmd.exe	cmd.exe
PID 524 wrote to memory of 2204	524	cmd.exe	cmd.exe
PID 524 wrote to memory of 2204	524	cmd.exe	cmd.exe
PID 524 wrote to memory of 536	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 536	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 536	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 3524	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 3524	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 3524	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 1888	524	cmd.exe	cmd.exe
PID 524 wrote to memory of 1888	524	cmd.exe	cmd.exe
PID 524 wrote to memory of 1888	524	cmd.exe	cmd.exe
PID 524 wrote to memory of 4988	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 4988	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 4988	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 2632	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 2632	524	cmd.exe	cacls.exe
PID 524 wrote to memory of 2632	524	cmd.exe	cacls.exe
PID 3336 wrote to memory of 4840	3336	mnolyk.exe	rundll32.exe
PID 3336 wrote to memory of 4840	3336	mnolyk.exe	rundll32.exe
PID 3336 wrote to memory of 4840	3336	mnolyk.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe

"C:\Users\Admin\AppData\Local\Temp\840d1f16a93cee9ee46c66ef63bc9227ebfb23465bc19abc7e216d2471e19a84.exe"

Adds Run key to start application
Suspicious use of WriteProcessMemory

PID:2760

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cUMn.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cUMn.exe

Executes dropped EXE
Adds Run key to start application
Suspicious use of WriteProcessMemory

PID:4036

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aUMx.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aUMx.exe

Modifies Windows Defender Real-time Protection settings
Executes dropped EXE
Windows security modification
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:2924

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe

Modifies Windows Defender Real-time Protection settings
Executes dropped EXE
Windows security modification
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:4268

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe

Executes dropped EXE
Suspicious use of WriteProcessMemory

PID:3556

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"

Executes dropped EXE
Suspicious use of WriteProcessMemory

PID:3336

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F

Creates scheduled task(s)

PID:1752

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit

Suspicious use of WriteProcessMemory

PID:524

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

PID:2204

C:\Windows\SysWOW64\cacls.exe

CACLS "mnolyk.exe" /P "Admin:N"

PID:536

C:\Windows\SysWOW64\cacls.exe

CACLS "mnolyk.exe" /P "Admin:R" /E

PID:3524

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

PID:1888

C:\Windows\SysWOW64\cacls.exe

CACLS "..\5eb6b96734" /P "Admin:N"

PID:4988

C:\Windows\SysWOW64\cacls.exe

CACLS "..\5eb6b96734" /P "Admin:R" /E

PID:2632

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

Loads dropped DLL

PID:4840

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

Executes dropped EXE

PID:1716

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

Executes dropped EXE

PID:4268

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Discovery

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cUMn.exe
Filesize
371KB

MD5
32292745cd12e3b089c183a3165a851e

SHA1
8e11ac03020e611e51cf5f1f919f20ca80101b12

SHA256
a97ef4302d6b868673eafc8c921afb7917d0f893c634b509e680e02dbac41bfa

SHA512
8a8395b317601d0f3cd1504540316b52df108c7ad8bc10f7be51293c80cf55232066343f8f0a555031d8e4656863074c9f349b32f4901c0e4445ee36243a4364

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cUMn.exe
Filesize
371KB

MD5
32292745cd12e3b089c183a3165a851e

SHA1
8e11ac03020e611e51cf5f1f919f20ca80101b12

SHA256
a97ef4302d6b868673eafc8c921afb7917d0f893c634b509e680e02dbac41bfa

SHA512
8a8395b317601d0f3cd1504540316b52df108c7ad8bc10f7be51293c80cf55232066343f8f0a555031d8e4656863074c9f349b32f4901c0e4445ee36243a4364

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe
Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe
Filesize
236KB

MD5
fde8915d251fada3a37530421eb29dcf

SHA1
44386a8947ddfab993409945dae05a772a13e047

SHA256
6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

SHA512
ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aUMx.exe
Filesize
341KB

MD5
3e992824465f02894e443cc255fff678

SHA1
0c95d1a78a548c60da4f2c15465efd2e122bb8da

SHA256
44946a180522e0a95656ed6be0cdb70acf648b7c3eae27850762ac344b05f8d0

SHA512
becd6d844a43ad48d6c0b9af2cbf15b7f6085c5bab5c4eae4bd909b0064c7fca22a6601b94416f86a9e51a4a6f88cdbe73723a2862ff25c222b2f75809d3b9a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aUMx.exe
Filesize
341KB

MD5
3e992824465f02894e443cc255fff678

SHA1
0c95d1a78a548c60da4f2c15465efd2e122bb8da

SHA256
44946a180522e0a95656ed6be0cdb70acf648b7c3eae27850762ac344b05f8d0

SHA512
becd6d844a43ad48d6c0b9af2cbf15b7f6085c5bab5c4eae4bd909b0064c7fca22a6601b94416f86a9e51a4a6f88cdbe73723a2862ff25c222b2f75809d3b9a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
9221a421a3e777eb7d4ce55e474bcc4a

SHA1
c96d7bd7ccbf9352d50527bff472595b3dc5298e

SHA256
10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8

SHA512
63ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
9221a421a3e777eb7d4ce55e474bcc4a

SHA1
c96d7bd7ccbf9352d50527bff472595b3dc5298e

SHA256
10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8

SHA512
63ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3

Download Submit
memory/524-402-0x0000000000000000-mapping.dmp

Download
memory/536-460-0x0000000000000000-mapping.dmp

Download
memory/1752-397-0x0000000000000000-mapping.dmp

Download
memory/1888-535-0x0000000000000000-mapping.dmp

Download
memory/2204-457-0x0000000000000000-mapping.dmp

Download
memory/2632-590-0x0000000000000000-mapping.dmp

Download
memory/2760-136-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-162-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-142-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-143-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-144-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-145-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-146-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-147-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-148-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-150-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-149-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-151-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-152-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-153-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-154-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-155-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-156-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-157-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-159-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-158-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-160-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-161-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-163-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-141-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-164-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-165-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-140-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-138-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-139-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-137-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-135-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-134-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-133-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-132-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-131-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-130-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-129-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-128-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-127-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-126-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-125-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-124-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-123-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-122-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-120-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2760-121-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/2924-281-0x0000000002510000-0x0000000002528000-memory.dmp

Filesize
96KB

Download
memory/2924-215-0x0000000000000000-mapping.dmp

Download
memory/2924-267-0x0000000000480000-0x00000000005CA000-memory.dmp

Filesize
1MB

Download
memory/2924-268-0x00000000006A0000-0x00000000006CD000-memory.dmp

Filesize
180KB

Download
memory/2924-270-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2924-275-0x0000000002300000-0x000000000231A000-memory.dmp

Filesize
104KB

Download
memory/2924-279-0x0000000004A50000-0x0000000004F4E000-memory.dmp

Filesize
4MB

Download
memory/2924-284-0x0000000000480000-0x00000000005CA000-memory.dmp

Filesize
1MB

Download
memory/2924-286-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3336-344-0x0000000000000000-mapping.dmp

Download
memory/3524-519-0x0000000000000000-mapping.dmp

Download
memory/3556-291-0x0000000000000000-mapping.dmp

Download
memory/4036-181-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-179-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-182-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-170-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-171-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-183-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-180-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-185-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-172-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-173-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-176-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-184-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-178-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-177-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-186-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-175-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-169-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4036-166-0x0000000000000000-mapping.dmp

Download
memory/4036-168-0x00000000771E0000-0x000000007736E000-memory.dmp

Filesize
1MB

Download
memory/4268-287-0x0000000000000000-mapping.dmp

Download
memory/4268-290-0x0000000000F20000-0x0000000000F2A000-memory.dmp

Filesize
40KB

Download
memory/4840-636-0x0000000000000000-mapping.dmp

Download
memory/4988-537-0x0000000000000000-mapping.dmp

Download