amadey | bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
17-04-2023 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe
Size

982KB
MD5

290e652ce863f5d463724e9981e02051
SHA1

9d67838aaba137361a43f8bba40306e4d1b5c10e
SHA256

bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35
SHA512

0fefd8c231917bb969cae6caf2cb92aafd47bd23700e687f4e439c09c71d06055302afc2c639d9f7097504179962d40655d34ef619f1ddc763a08695242d4f05
SSDEEP

24576:4yenCjpLDkuvLh6v1JzdY1+TMsv8cYwNBYCytOlqonebDV8+cQj:/42X161xA5sv8cpBYCczvbB

Score

10^/10

amadey discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr072619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr072619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr072619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr072619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr072619.exe

Executes dropped EXE 6 IoCs

pid	Process
3652	un800705.exe
4608	un316846.exe
5008	pr072619.exe
4260	qu487212.exe
712	rk351268.exe
1412	si451653.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr072619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr072619.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un800705.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un800705.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un316846.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un316846.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1708	1412	WerFault.exe	72
4652	1412	WerFault.exe	72
4800	1412	WerFault.exe	72
2092	1412	WerFault.exe	72
4332	1412	WerFault.exe	72
2556	1412	WerFault.exe	72
2812	1412	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5008	pr072619.exe
5008	pr072619.exe
4260	qu487212.exe
4260	qu487212.exe
712	rk351268.exe
712	rk351268.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	pr072619.exe
Token: SeDebugPrivilege	4260	qu487212.exe
Token: SeDebugPrivilege	712	rk351268.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 3652	420	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe	66
PID 420 wrote to memory of 3652	420	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe	66
PID 420 wrote to memory of 3652	420	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe	66
PID 3652 wrote to memory of 4608	3652	un800705.exe	67
PID 3652 wrote to memory of 4608	3652	un800705.exe	67
PID 3652 wrote to memory of 4608	3652	un800705.exe	67
PID 4608 wrote to memory of 5008	4608	un316846.exe	68
PID 4608 wrote to memory of 5008	4608	un316846.exe	68
PID 4608 wrote to memory of 5008	4608	un316846.exe	68
PID 4608 wrote to memory of 4260	4608	un316846.exe	69
PID 4608 wrote to memory of 4260	4608	un316846.exe	69
PID 4608 wrote to memory of 4260	4608	un316846.exe	69
PID 3652 wrote to memory of 712	3652	un800705.exe	71
PID 3652 wrote to memory of 712	3652	un800705.exe	71
PID 3652 wrote to memory of 712	3652	un800705.exe	71
PID 420 wrote to memory of 1412	420	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe	72
PID 420 wrote to memory of 1412	420	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe	72
PID 420 wrote to memory of 1412	420	bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe	72

C:\Users\Admin\AppData\Local\Temp\bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe
"C:\Users\Admin\AppData\Local\Temp\bbdb8b28b0b930cae3c0c66ab4fc2e446c7bb8fa989bd3deef5d82f5dc780b35.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:420
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un800705.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un800705.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un316846.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un316846.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr072619.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr072619.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu487212.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu487212.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk351268.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk351268.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si451653.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si451653.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 644
    3⤵
    - Program crash
    PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 720
    3⤵
    - Program crash
    PID:4652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 848
    3⤵
    - Program crash
    PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 856
    3⤵
    - Program crash
    PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 884
    3⤵
    - Program crash
    PID:4332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 908
    3⤵
    - Program crash
    PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 1056
    3⤵
    - Program crash
    PID:2812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si451653.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si451653.exe

Filesize
246KB

MD5
ac3eb194ed5ab3b80a14e8189174a171

SHA1
c888d21cbdb7d01e02b5bb199d070a18c23cfda6

SHA256
708c0153842214059ea1aa8bd40086850cb5cfbc58300f18d7b6421b2d34ed38

SHA512
a776e533d4d3f483bdb649a116d4c1c5dde9617466ceacbe2ad8ffbb7ee3ea9405ee69f1ac3db2e0a2fd6c738d5bc9e7b8cf20b0753a4761d3981b249fc0b3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un800705.exe

Filesize
709KB

MD5
fdcc95209293a615b34f39d0d73c918c

SHA1
99ccf2ad620958e462fbaa0c85bc7c164868d94f

SHA256
29f396bcbe6f7ab4e5cbab989d5cd9bd35d25dd93d528410f165445c64344591

SHA512
4fa808afeadc426ee3364d92e0a37fbd69589113cd7cb86b350c308261161803b4b81b275dfb8830e8d7792091a4352b6e4f3b0d2a6711ad6f51a5bc07d1c103

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un800705.exe

Filesize
709KB

MD5
fdcc95209293a615b34f39d0d73c918c

SHA1
99ccf2ad620958e462fbaa0c85bc7c164868d94f

SHA256
29f396bcbe6f7ab4e5cbab989d5cd9bd35d25dd93d528410f165445c64344591

SHA512
4fa808afeadc426ee3364d92e0a37fbd69589113cd7cb86b350c308261161803b4b81b275dfb8830e8d7792091a4352b6e4f3b0d2a6711ad6f51a5bc07d1c103

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk351268.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk351268.exe

Filesize
136KB

MD5
359db2338ae0f977dcf10e90cf9816fb

SHA1
94126cb670e5f434e555c991c967e0ee98fae552

SHA256
5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc

SHA512
d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un316846.exe

Filesize
555KB

MD5
7ceca6c48074a416e7d8260ae1f93e8e

SHA1
2084fcdb7ac097a2958562fda3dbbf0b31e8a86e

SHA256
f5acfc9806f57e3219569084b7543b0d6e5a8ed534b4c1ce24d54bb43112fce2

SHA512
ca5866919451e486889bb52e331b7c8a76be25d3e5f03ad3360fa833eb3463bce3266243ae982aee1d3a48015e7bb41e607212795d623055242cb42c209a2dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un316846.exe

Filesize
555KB

MD5
7ceca6c48074a416e7d8260ae1f93e8e

SHA1
2084fcdb7ac097a2958562fda3dbbf0b31e8a86e

SHA256
f5acfc9806f57e3219569084b7543b0d6e5a8ed534b4c1ce24d54bb43112fce2

SHA512
ca5866919451e486889bb52e331b7c8a76be25d3e5f03ad3360fa833eb3463bce3266243ae982aee1d3a48015e7bb41e607212795d623055242cb42c209a2dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr072619.exe

Filesize
255KB

MD5
0e4d4b68212db5b384b4b353a7fd0c8b

SHA1
bd5902a1538113176402888cdf905a32c233a925

SHA256
435bb68973557574c018c68a35361ab1e9a1c5a0c0d9ec674666dcb5caa1f96a

SHA512
bc96f543e19e3ae5751df616f2a4189ec7599ab1776bc01be070f75fb7316df6cdbb20bc8e15dfc397ba40a8d79b59d3aedd1a57a3ec0eb234ba4c6511f5c98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr072619.exe

Filesize
255KB

MD5
0e4d4b68212db5b384b4b353a7fd0c8b

SHA1
bd5902a1538113176402888cdf905a32c233a925

SHA256
435bb68973557574c018c68a35361ab1e9a1c5a0c0d9ec674666dcb5caa1f96a

SHA512
bc96f543e19e3ae5751df616f2a4189ec7599ab1776bc01be070f75fb7316df6cdbb20bc8e15dfc397ba40a8d79b59d3aedd1a57a3ec0eb234ba4c6511f5c98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu487212.exe

Filesize
337KB

MD5
b870ed1cfe52b1c09ce69600bea0f265

SHA1
abfb1c72fb8aee6bc1402472f6c50cc033877b27

SHA256
14f6b60e2d0f1179d1ecbb33effc00c50072ac6428cabf8638b152b872958a41

SHA512
1a0e302dae1fa864df96e8225798cc22ecdd0fc1b9d6beed5f71b0fcf9d01ad9e69bda11b8b7dfaebe2496df7c463d9da26fae5038b57f5c1141b191c8941889

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu487212.exe

Filesize
337KB

MD5
b870ed1cfe52b1c09ce69600bea0f265

SHA1
abfb1c72fb8aee6bc1402472f6c50cc033877b27

SHA256
14f6b60e2d0f1179d1ecbb33effc00c50072ac6428cabf8638b152b872958a41

SHA512
1a0e302dae1fa864df96e8225798cc22ecdd0fc1b9d6beed5f71b0fcf9d01ad9e69bda11b8b7dfaebe2496df7c463d9da26fae5038b57f5c1141b191c8941889

Download Submit
memory/712-999-0x0000000007AB0000-0x0000000007AC0000-memory.dmp

Filesize
64KB

Download
memory/712-998-0x0000000007730000-0x000000000777B000-memory.dmp

Filesize
300KB

Download
memory/712-997-0x00000000009B0000-0x00000000009D8000-memory.dmp

Filesize
160KB

Download
memory/1412-1005-0x0000000000830000-0x000000000086B000-memory.dmp

Filesize
236KB

Download
memory/4260-980-0x0000000007B10000-0x0000000007B22000-memory.dmp

Filesize
72KB

Download
memory/4260-208-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-991-0x0000000008B80000-0x00000000090AC000-memory.dmp

Filesize
5.2MB

Download
memory/4260-990-0x00000000089B0000-0x0000000008B72000-memory.dmp

Filesize
1.8MB

Download
memory/4260-989-0x0000000008860000-0x00000000088B0000-memory.dmp

Filesize
320KB

Download
memory/4260-988-0x0000000008790000-0x00000000087AE000-memory.dmp

Filesize
120KB

Download
memory/4260-987-0x00000000086D0000-0x0000000008746000-memory.dmp

Filesize
472KB

Download
memory/4260-986-0x0000000008630000-0x00000000086C2000-memory.dmp

Filesize
584KB

Download
memory/4260-985-0x0000000007F70000-0x0000000007FD6000-memory.dmp

Filesize
408KB

Download
memory/4260-984-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4260-983-0x0000000007DE0000-0x0000000007E2B000-memory.dmp

Filesize
300KB

Download
memory/4260-982-0x0000000007C60000-0x0000000007C9E000-memory.dmp

Filesize
248KB

Download
memory/4260-981-0x0000000007B40000-0x0000000007C4A000-memory.dmp

Filesize
1.0MB

Download
memory/4260-979-0x0000000007490000-0x0000000007A96000-memory.dmp

Filesize
6.0MB

Download
memory/4260-333-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4260-331-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4260-181-0x00000000049E0000-0x0000000004A1C000-memory.dmp

Filesize
240KB

Download
memory/4260-182-0x0000000004F90000-0x0000000004FCA000-memory.dmp

Filesize
232KB

Download
memory/4260-184-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-183-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-186-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-188-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-190-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-192-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-194-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-196-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-198-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-200-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-202-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-204-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-206-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-329-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4260-210-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-212-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-214-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-216-0x0000000004F90000-0x0000000004FC5000-memory.dmp

Filesize
212KB

Download
memory/4260-327-0x00000000020C0000-0x0000000002106000-memory.dmp

Filesize
280KB

Download
memory/5008-163-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-141-0x00000000022A0000-0x00000000022BA000-memory.dmp

Filesize
104KB

Download
memory/5008-153-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-176-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/5008-149-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-174-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/5008-173-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/5008-172-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/5008-171-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-169-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-139-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/5008-151-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-159-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-161-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-155-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-157-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-147-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-145-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-144-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-143-0x0000000002460000-0x0000000002478000-memory.dmp

Filesize
96KB

Download
memory/5008-142-0x0000000004BB0000-0x00000000050AE000-memory.dmp

Filesize
5.0MB

Download
memory/5008-165-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/5008-140-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/5008-167-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download