amadey | 7067efc25c133206570865eb8e8063d59894e5a3c457e287ca050d6fc3d182d4

Analysis

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ama.exe
Size 4.2MB
Sample240103-g67c8acbak
SHA256 7067efc25c133206570865eb8e8063d59894e5a3c457e287ca050d6fc3d182d4
MD5 85063be1269280d47cd7a92ac929e8d7
SHA1 263410e5468c34b22002ddd6c38c0edec54c5130
SHA512 68f3a7be4d89fb4a2d09163c5d90f60c9036b3329f9ae5a718a17611b8105eee35d87b4ed598a44d1933f761952eaf60ea3f9c85f8da0cf4ed42ffc0653c69db
SSDEEP 98304:aXQL86ZtG2fZyxobYPe9qVg8xhctOiJbA/N5NOL9L+xBgq:aXCU2fZWCYPe9uhg8iG2R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.13

http://185.172.128.5

Attributes

install_dir
4fdb51ccdc
install_file
Utsysc.exe
strings_key
11bb398ff31ee80d2c37571aecd1d36d
url_paths
/v8sjh3hs8/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ama.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Utsysc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Utsysc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Utsysc.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2296	rundll32.exe
12	2456	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ama.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ama.exe

Executes dropped EXE 3 IoCs

pid	Process
2848	Utsysc.exe
1652	Utsysc.exe
2844	Utsysc.exe

Loads dropped DLL 14 IoCs

pid	Process
760	ama.exe
760	ama.exe
2120	rundll32.exe
2120	rundll32.exe
2120	rundll32.exe
2120	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2456	rundll32.exe
2456	rundll32.exe
2456	rundll32.exe
2456	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Utsysc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ama.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Utsysc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
760	ama.exe
2848	Utsysc.exe
1652	Utsysc.exe
2844	Utsysc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
760	ama.exe
2848	Utsysc.exe
2296	rundll32.exe
2296	rundll32.exe
1652	Utsysc.exe
2296	rundll32.exe
2296	rundll32.exe
1184	powershell.exe
2844	Utsysc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
760	ama.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2848	760	ama.exe	28
PID 760 wrote to memory of 2848	760	ama.exe	28
PID 760 wrote to memory of 2848	760	ama.exe	28
PID 760 wrote to memory of 2848	760	ama.exe	28
PID 2848 wrote to memory of 2888	2848	Utsysc.exe	29
PID 2848 wrote to memory of 2888	2848	Utsysc.exe	29
PID 2848 wrote to memory of 2888	2848	Utsysc.exe	29
PID 2848 wrote to memory of 2888	2848	Utsysc.exe	29
PID 1096 wrote to memory of 1652	1096	taskeng.exe	36
PID 1096 wrote to memory of 1652	1096	taskeng.exe	36
PID 1096 wrote to memory of 1652	1096	taskeng.exe	36
PID 1096 wrote to memory of 1652	1096	taskeng.exe	36
PID 2848 wrote to memory of 2120	2848	Utsysc.exe	37
PID 2848 wrote to memory of 2120	2848	Utsysc.exe	37
PID 2848 wrote to memory of 2120	2848	Utsysc.exe	37
PID 2848 wrote to memory of 2120	2848	Utsysc.exe	37
PID 2848 wrote to memory of 2120	2848	Utsysc.exe	37
PID 2848 wrote to memory of 2120	2848	Utsysc.exe	37
PID 2848 wrote to memory of 2120	2848	Utsysc.exe	37
PID 2120 wrote to memory of 2296	2120	rundll32.exe	38
PID 2120 wrote to memory of 2296	2120	rundll32.exe	38
PID 2120 wrote to memory of 2296	2120	rundll32.exe	38
PID 2120 wrote to memory of 2296	2120	rundll32.exe	38
PID 2296 wrote to memory of 2320	2296	rundll32.exe	39
PID 2296 wrote to memory of 2320	2296	rundll32.exe	39
PID 2296 wrote to memory of 2320	2296	rundll32.exe	39
PID 2296 wrote to memory of 1184	2296	rundll32.exe	41
PID 2296 wrote to memory of 1184	2296	rundll32.exe	41
PID 2296 wrote to memory of 1184	2296	rundll32.exe	41
PID 2848 wrote to memory of 2456	2848	Utsysc.exe	44
PID 2848 wrote to memory of 2456	2848	Utsysc.exe	44
PID 2848 wrote to memory of 2456	2848	Utsysc.exe	44
PID 2848 wrote to memory of 2456	2848	Utsysc.exe	44
PID 2848 wrote to memory of 2456	2848	Utsysc.exe	44
PID 2848 wrote to memory of 2456	2848	Utsysc.exe	44
PID 2848 wrote to memory of 2456	2848	Utsysc.exe	44
PID 1096 wrote to memory of 2844	1096	taskeng.exe	46
PID 1096 wrote to memory of 2844	1096	taskeng.exe	46
PID 1096 wrote to memory of 2844	1096	taskeng.exe	46
PID 1096 wrote to memory of 2844	1096	taskeng.exe	46

C:\Users\Admin\AppData\Local\Temp\ama.exe
"C:\Users\Admin\AppData\Local\Temp\ama.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2888
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:2320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\427588347149_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:2456

C:\Windows\system32\taskeng.exe
taskeng.exe {9C03E0DB-607E-460B-804D-5D0A89805326} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
  C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
  C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

427588347149

Path C:\Users\Admin\AppData\Local\Temp\427588347149
Size 63KB
SHA256 487b56f799ad47bdc2e206308976ed652bd00df1d87a08e472dffc5e586cab6d
MD5 13b344e5eddcc2e94f7406f202892d1f
SHA1 57613c38b1def62740d19c860c8d7585b6760299
SHA512 860545763e9a64b2df55caad291f4badb900f1be549cf5805f96634aea7268d31923a1db183e4ab0a4c572b48c85d974c097e92bc382da2c6daf0c345321d99a
SSDEEP 1536:ssHkqHBrqCRiL2lhF+aDyTC7rU4dFkWvm14YoaQGAVqBgaa13aX:3YCsSlCTmDdFE1gGAVqBgaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Size 4.2MB
SHA256 7067efc25c133206570865eb8e8063d59894e5a3c457e287ca050d6fc3d182d4
MD5 85063be1269280d47cd7a92ac929e8d7
SHA1 263410e5468c34b22002ddd6c38c0edec54c5130
SHA512 68f3a7be4d89fb4a2d09163c5d90f60c9036b3329f9ae5a718a17611b8105eee35d87b4ed598a44d1933f761952eaf60ea3f9c85f8da0cf4ed42ffc0653c69db
SSDEEP 98304:aXQL86ZtG2fZyxobYPe9qVg8xhctOiJbA/N5NOL9L+xBgq:aXCU2fZWCYPe9uhg8iG2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Size 1.4MB
SHA256 2f839d96a67181574dc8c8b8a1ed1036eb5a7e3916c9abe1441e9440a5af4a27
MD5 f646f6a209fa09d0c2038c07d8578d17
SHA1 952a37ffc08f4e6bce35711bbd75e13439237eb2
SHA512 c85f34ffe3ae36e939a4c855cc43d2451c0d447b1100d6756a0743e1e3b59aa1f6a949834139fa613e1b444f3a07c789a482101f80a6e637cdaa0e83fe44c975
SSDEEP 24576:YHt5bPOhulN+RDd0X/+Hay86XRKEQnYPWD4tkKWLqN0xObVijQRyvZoMUzh2q:UDPlNg0X/YL86XUai4tSL2jbV3yxoMUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Size 1.1MB
SHA256 d40a199c17b49996b71c5edc51e3d00953069cdb3b70ad9bfcd729ba96a4342d
MD5 b81c3a2d4e44381770bcb9669aa9e1ad
SHA1 a7321b24cedc4942e6a779bb31220f7f10eee9f3
SHA512 56e1a9ff2ddaaaaae427369ce323b4c707976ad36388c546d8286629169aaa8f72312ee597e24c4c53f1c43b90657406ae21ccae3b999f0a79d2d06da90b4d36
SSDEEP 24576:YHt5bPOhulN+RDd0X/+Hay86XRKEQnYPWD4tkKWLqN0xObViR:UDPlNg0X/YL86XUai4tSL2jbVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Size 1.6MB
SHA256 38f57da718c13b534d27b51a630f57e5d49de0a3e0ea77faf14b2645a29b65d0
MD5 61c21029149798489e5323c7f6482939
SHA1 9300a39d7676557847edceb8b2aabb22f04f26c4
SHA512 4938b80364dfbc6fbc0a2fef9a11e9150dcccbf235d161b4140ef78574e6edd6889729582afb29f656d930b78d10bb2a2731d5d14bfc6c21367f086beae0d204
SSDEEP 49152:UDPlNg0X/YL86XUai4tSL2jbV3yxoMUY3/zd+:aXQL86ZtG2fZyxobYPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\clip64.dll
Size 102KB
SHA256 f5d35a2366cf13312a30c9384f1ac30d9dc9ced46fa6b1b9c2d0621493cc2495
MD5 c06513af505f65393b4ebcd2a11a2ee4
SHA1 6e9e8a6b93fc9afbcc781790881d821b0bfb0821
SHA512 b90b8dc0571b2dde83c5ceaa4f12f203973bc2049663c0a840fa20a900bc7018f1f392f10273a607e816ccaf8a2b4f70bbc30b354437a2c9aecf5626b7c0a5ce
SSDEEP 3072:ewTxt8T+Mz7G2MosmfNuQR/SrT7BUEYW0Z:eQ7R0PseNuQREmW0Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\80c6bf70bf3f8f\cred64.dll
Size 1.2MB
SHA256 48c4c53425a0ee02d48f3eab2b4da3b6ed24d6d5bc45dea783e43e32b9752931
MD5 38d922b1364ecc07f1a933b7acb20de4
SHA1 82a3d4f9cf3502da8710c07f9b7b447b79519216
SHA512 cb1ca40afc5ad7828c9ef79c8029e76ec351bbbf6697ab1ec6dd9fe7aa5273028cf9d711a9babb4444ab44266751affbb3de4f4c9572dea102b1a04e95f0d315
SSDEEP 24576:sBWK58Kl3nZZPCQVQHX+sMoCRVTzfolqaA:El3nZEwQufZzQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path \Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Size 1.6MB
SHA256 d65f662c6382edb8c093bb3f087dac6c309d8895517c8e8083fe76abc691a11a
MD5 c34e662472f07d7fc4cdbd03c89d1c2a
SHA1 087bfad46f4820fa1a09b13d2dfa9c35bc820e77
SHA512 ae153e754a3e9b1f70dbc200ca3609a267276b58074bbeacd816eef2cb023fdc4c1001053b94ce20d62344f0403022cbb5e8138a0b08b7a46dc70822ffabbfc2
SSDEEP 49152:UDPlNg0X/YL86XUai4tSL2jbV3yxoMUY3/zH:aXQL86ZtG2fZyxobYPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path \Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
Size 1.9MB
SHA256 9d3aee04fec0792decbc91384c948aaa13cdc68a150840eb0d920beb70458ced
MD5 7cd62a2ff211115cdb94784f200cf607
SHA1 90cbce22a19d7501cf04f601439d63efa9bf4f6e
SHA512 8c13d833986253165798ac19116222ab6a94b9034ce8d603f9e71ed44bc408fa22a1439ee3e74db3f3ec5906f3699d7d108d33383783ce0540f3efa23400ee69
SSDEEP 49152:UDPlNg0X/YL86XUai4tSL2jbV3yxoMUY3/zdY3EUnq9oUzEK7:aXQL86ZtG2fZyxobYPe9qVgc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-64-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-1-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-19-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-20-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-21-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-22-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-23-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-24-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-25-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-26-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-28-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-29-0x0000000077560000-0x0000000077562000-memory.dmp

Download

memory/760-27-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-30-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-31-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-32-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-33-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-34-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/760-17-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-16-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-15-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-45-0x0000000004420000-0x000000000502C000-memory.dmp

Download

memory/760-14-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-13-0x0000000076AD0000-0x0000000076B17000-memory.dmp

Download

memory/760-2-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-116-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-48-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-51-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-52-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-5-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-54-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-55-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-56-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-57-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-58-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-59-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-60-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-61-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-63-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-0-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/760-65-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-67-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-68-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-69-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-18-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-53-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/760-50-0x0000000076AD0000-0x0000000076B17000-memory.dmp

Download

memory/760-12-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/1652-108-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/1652-147-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/1652-158-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/1652-152-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/1652-149-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/1652-143-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/1652-113-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/1652-109-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2844-227-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2844-252-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2844-248-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2844-246-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-117-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-49-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-95-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-96-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-81-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-80-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-78-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-71-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-88-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-87-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-115-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-79-0x0000000076AD0000-0x0000000076B17000-memory.dmp

Download

memory/2848-90-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-119-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-118-0x0000000076AD0000-0x0000000076B17000-memory.dmp

Download

memory/2848-94-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-86-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-144-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-146-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-82-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-85-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-84-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-83-0x0000000076AD0000-0x0000000076B17000-memory.dmp

Download

memory/2848-47-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-219-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-93-0x0000000000400000-0x000000000100C000-memory.dmp

Download

memory/2848-91-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-92-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download

memory/2848-89-0x0000000076B50000-0x0000000076C60000-memory.dmp

Download