amadey | c406b733897d091408ed5a656cfbf043623a8d08092269918184ccefd87971f0

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Amdau.exe
Size

3.2MB
MD5

c3ee25c18f2c408c9054d9c6d4c1e147
SHA1

80d2395709b713647b199c22fdec5415d3a68052
SHA256

c406b733897d091408ed5a656cfbf043623a8d08092269918184ccefd87971f0
SHA512

d91a1675ca9a2923020ce244d00da6a9b686240dc7ef50185709ecbc2f6b8f92c371ee94ec277a2d3b0e33704c532d2f8779b39ac9f630b9b40f0794312d72f4
SSDEEP

24576:0cUe92VHXy4fv6hfZQGwSWF6r+tLq9rNE0TR5sTlcJxbTGX+tIonLiMjrWD:rt9L4p7GJEeR51TGX10LPjrWD

Score

10^/10

amadey evasion trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://45.9.74.182/b7djSDcPcZ/index.php

Attributes

install_dir
f3f10bd848
install_file
bstyoops.exe
strings_key
05986a1cda6dc6caabf469f27fb6c32d

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

clip.exeLEAJ.exeLEAJ.exeLEAJ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	clip.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LEAJ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LEAJ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LEAJ.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LEAJ.exeLEAJ.exeLEAJ.execlip.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	clip.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	clip.exe

Drops startup file 1 IoCs

Processes:

Amdau.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edddegyjjykj.lnk Amdau.exe
Executes dropped EXE 4 IoCs

Processes:

clip.exeLEAJ.exeLEAJ.exeLEAJ.exe

pid process

812 clip.exe
760 LEAJ.exe
2024 LEAJ.exe
1468 LEAJ.exe
Loads dropped DLL 3 IoCs

Processes:

jsc.exeAmdau.execmd.exe

pid process

2732 jsc.exe
2980 Amdau.exe
1716 cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edddegyjjykj.lnk	Amdau.exe

pid	process
812	clip.exe
760	LEAJ.exe
2024	LEAJ.exe
1468	LEAJ.exe

pid	process
2732	jsc.exe
2980	Amdau.exe
1716	cmd.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

LEAJ.exeLEAJ.exeLEAJ.execlip.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LEAJ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	clip.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

clip.exeLEAJ.exeLEAJ.exeLEAJ.exe

pid process

812 clip.exe
760 LEAJ.exe
2024 LEAJ.exe
1468 LEAJ.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Amdau.exe

description pid process target process

PID 2980 set thread context of 2732 2980 Amdau.exe jsc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

268 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1880 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Amdau.exe

description pid process

Token: SeDebugPrivilege 2980 Amdau.exe

pid	process
812	clip.exe
760	LEAJ.exe
2024	LEAJ.exe
1468	LEAJ.exe

description	pid	process	target process
PID 2980 set thread context of 2732	2980	Amdau.exe	jsc.exe

pid	process
268	schtasks.exe

pid	process
1880	timeout.exe

description	pid	process
Token: SeDebugPrivilege	2980	Amdau.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

Amdau.exejsc.execlip.execmd.exeLEAJ.exetaskeng.exe

description	pid	process	target process
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2980 wrote to memory of 2732	2980	Amdau.exe	jsc.exe
PID 2732 wrote to memory of 812	2732	jsc.exe	clip.exe
PID 2732 wrote to memory of 812	2732	jsc.exe	clip.exe
PID 2732 wrote to memory of 812	2732	jsc.exe	clip.exe
PID 2732 wrote to memory of 812	2732	jsc.exe	clip.exe
PID 2732 wrote to memory of 812	2732	jsc.exe	clip.exe
PID 2732 wrote to memory of 812	2732	jsc.exe	clip.exe
PID 2732 wrote to memory of 812	2732	jsc.exe	clip.exe
PID 812 wrote to memory of 1716	812	clip.exe	cmd.exe
PID 812 wrote to memory of 1716	812	clip.exe	cmd.exe
PID 812 wrote to memory of 1716	812	clip.exe	cmd.exe
PID 812 wrote to memory of 1716	812	clip.exe	cmd.exe
PID 1716 wrote to memory of 1880	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 1880	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 1880	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 1880	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 760	1716	cmd.exe	LEAJ.exe
PID 1716 wrote to memory of 760	1716	cmd.exe	LEAJ.exe
PID 1716 wrote to memory of 760	1716	cmd.exe	LEAJ.exe
PID 1716 wrote to memory of 760	1716	cmd.exe	LEAJ.exe
PID 1716 wrote to memory of 760	1716	cmd.exe	LEAJ.exe
PID 1716 wrote to memory of 760	1716	cmd.exe	LEAJ.exe
PID 1716 wrote to memory of 760	1716	cmd.exe	LEAJ.exe
PID 760 wrote to memory of 268	760	LEAJ.exe	schtasks.exe
PID 760 wrote to memory of 268	760	LEAJ.exe	schtasks.exe
PID 760 wrote to memory of 268	760	LEAJ.exe	schtasks.exe
PID 760 wrote to memory of 268	760	LEAJ.exe	schtasks.exe
PID 2132 wrote to memory of 2024	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 2024	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 2024	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 2024	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 2024	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 2024	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 2024	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 1468	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 1468	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 1468	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 1468	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 1468	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 1468	2132	taskeng.exe	LEAJ.exe
PID 2132 wrote to memory of 1468	2132	taskeng.exe	LEAJ.exe

C:\Users\Admin\AppData\Local\Temp\Amdau.exe
"C:\Users\Admin\AppData\Local\Temp\Amdau.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\1001233051\clip.exe
    "C:\Users\Admin\AppData\Local\Temp\1001233051\clip.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\smk.0.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1880
    - - C:\ProgramData\presepuesto\LEAJ.exe
        
        "C:\ProgramData\presepuesto\LEAJ.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:760
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
        6⤵
        Creates scheduled task(s)
        
        PID:268

C:\Windows\system32\taskeng.exe
taskeng.exe {7AC31ECC-EDD3-48E4-B68C-8EF73D3C6390} S-1-5-21-607259312-1573743425-2763420908-1000:NGTQGRML\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\ProgramData\presepuesto\LEAJ.exe
  C:\ProgramData\presepuesto\LEAJ.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2024
- C:\ProgramData\presepuesto\LEAJ.exe
  C:\ProgramData\presepuesto\LEAJ.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\presepuesto\LEAJ.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
C:\ProgramData\presepuesto\LEAJ.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
C:\ProgramData\presepuesto\LEAJ.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
C:\ProgramData\presepuesto\LEAJ.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001233051\clip.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001233051\clip.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001233051\clip.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
C:\Users\Admin\AppData\Local\Temp\smk.0.bat

Filesize
173B

MD5
1eddc00f28dd6fb2438163467cc10f17

SHA1
c80d9d2d26c0fb979c248d0016fed24485113e4c

SHA256
482f4f17ad348ac47569d4ad3a31dc7fa69df3e834e7a349497db2622585b154

SHA512
e6efb84f22286075a9cca60755b53c567d23c98e26fe30efcc34e51ad5016f0710f3e8493364877e9242f79607a0a2362a75834fb77fedba0cb178638e00943f

Download Submit
C:\Users\Admin\AppData\Local\Temp\smk.0.bat

Filesize
173B

MD5
1eddc00f28dd6fb2438163467cc10f17

SHA1
c80d9d2d26c0fb979c248d0016fed24485113e4c

SHA256
482f4f17ad348ac47569d4ad3a31dc7fa69df3e834e7a349497db2622585b154

SHA512
e6efb84f22286075a9cca60755b53c567d23c98e26fe30efcc34e51ad5016f0710f3e8493364877e9242f79607a0a2362a75834fb77fedba0cb178638e00943f

Download Submit
\ProgramData\presepuesto\LEAJ.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
\Users\Admin\AppData\Local\Temp\1001233051\clip.exe

Filesize
5.6MB

MD5
55a7682ff0b918010481c8daa6b76a32

SHA1
e18309e4cd12d8217bc0d0f2ae3d58bf1a70cf5e

SHA256
033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d

SHA512
794d5c4d0ec7d5e00931251cfbc9d6da56d1d9964d43272849f4a424a448dba6c1549fa1f011bd8d07c31230922bd76e6cb69e11c4438b552fce98b9589de606

Download Submit
\Users\Admin\Videos\edddegyjjykj.exe

Filesize
3.2MB

MD5
c3ee25c18f2c408c9054d9c6d4c1e147

SHA1
80d2395709b713647b199c22fdec5415d3a68052

SHA256
c406b733897d091408ed5a656cfbf043623a8d08092269918184ccefd87971f0

SHA512
d91a1675ca9a2923020ce244d00da6a9b686240dc7ef50185709ecbc2f6b8f92c371ee94ec277a2d3b0e33704c532d2f8779b39ac9f630b9b40f0794312d72f4

Download Submit
memory/760-107-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/760-106-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/760-105-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/760-100-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/760-96-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/812-70-0x0000000076F30000-0x0000000076F32000-memory.dmp

Filesize
8KB

Download
memory/812-83-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/812-71-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/812-69-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/812-63-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/812-60-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/812-59-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/1468-142-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/1716-95-0x00000000020B0000-0x0000000002171000-memory.dmp

Filesize
772KB

Download
memory/2024-111-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/2024-123-0x0000000000400000-0x0000000001219000-memory.dmp

Filesize
14.1MB

Download
memory/2732-91-0x0000000003960000-0x0000000004779000-memory.dmp

Filesize
14.1MB

Download
memory/2732-30-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-43-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-51-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-42-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-40-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-58-0x0000000003960000-0x0000000004779000-memory.dmp

Filesize
14.1MB

Download
memory/2732-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-37-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-36-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-44-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-35-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-34-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2732-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2980-28-0x0000000004610000-0x0000000004650000-memory.dmp

Filesize
256KB

Download
memory/2980-15-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-68-0x0000000004610000-0x0000000004650000-memory.dmp

Filesize
256KB

Download
memory/2980-27-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-25-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-90-0x0000000073D30000-0x000000007441E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-0-0x0000000000C90000-0x0000000000FC4000-memory.dmp

Filesize
3.2MB

Download
memory/2980-23-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-21-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-19-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-17-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-29-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2980-13-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-11-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-9-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-7-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-5-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-4-0x0000000000480000-0x0000000000495000-memory.dmp

Filesize
84KB

Download
memory/2980-3-0x0000000000480000-0x000000000049C000-memory.dmp

Filesize
112KB

Download
memory/2980-2-0x0000000073D30000-0x000000007441E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-1-0x0000000073D30000-0x000000007441E000-memory.dmp

Filesize
6.9MB

Download