amadey | faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390

Analysis

max time kernel
149s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
13-05-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe
Size

1.7MB
MD5

56f60bc166492f7e58b8e0d17c12ffe6
SHA1

1e297cbc6a7c3ab782ef00fadc6ad80318f234bf
SHA256

faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390
SHA512

135db640c24fa83f440980889fd9880fbec358d164663584dc14ef9414b3c7193d29a6bbbb8f7fe19c58be4ff6753da8783fe5303411e13c2073cf3f4680ccaf
SSDEEP

49152:niCNa/7VXdzEtIckSWFFDYUhmMnYhpdPf78dj:ittSK+kmMY3dLA

Score

10^/10

amadey risepro evasion persistence stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

4.20

http://5.42.96.141

http://5.42.96.7

Attributes

install_dir
908f070dff
install_file
explorku.exe
strings_key
b25a9385246248a95c600f9a061438e1
url_paths
/go34ko8/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	92ae20fbb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorku.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorku.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorku.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amers.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amers.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amers.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	92ae20fbb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorku.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	92ae20fbb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorku.exe

Executes dropped EXE 8 IoCs

pid	Process
2524	explorku.exe
1332	amers.exe
2160	axplons.exe
232	92ae20fbb9.exe
916	explorku.exe
1300	axplons.exe
5080	explorku.exe
2848	axplons.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine	amers.exe
Key opened	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine	axplons.exe

Themida packer 48 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5080-2-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-1-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-0-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-4-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-7-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-8-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-6-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-5-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/5080-3-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/files/0x000100000002aa0c-18.dat	themida
behavioral2/memory/2524-24-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/5080-21-0x0000000000E60000-0x00000000013B2000-memory.dmp	themida
behavioral2/memory/2524-23-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-27-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-29-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-28-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-26-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-25-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-22-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-30-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-31-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/2524-49-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/files/0x000100000002aa11-70.dat	themida
behavioral2/memory/232-84-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-88-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-85-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-87-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-91-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-86-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-90-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-92-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/232-89-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/2524-93-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/232-95-0x0000000000940000-0x0000000000FB6000-memory.dmp	themida
behavioral2/memory/916-105-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-103-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-102-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-104-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-109-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-108-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-106-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-107-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/916-111-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/5080-137-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/5080-136-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/5080-134-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/5080-135-0x0000000000120000-0x0000000000672000-memory.dmp	themida
behavioral2/memory/5080-144-0x0000000000120000-0x0000000000672000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\92ae20fbb9.exe = "C:\\Users\\Admin\\1000006002\\92ae20fbb9.exe"	explorku.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorku.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	92ae20fbb9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorku.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorku.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1332	amers.exe
2160	axplons.exe
1300	axplons.exe
2848	axplons.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorku.job	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe
File created	C:\Windows\Tasks\axplons.job	amers.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1332	amers.exe
1332	amers.exe
2160	axplons.exe
2160	axplons.exe
1300	axplons.exe
1300	axplons.exe
2848	axplons.exe
2848	axplons.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2524	5080	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe	80
PID 5080 wrote to memory of 2524	5080	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe	80
PID 5080 wrote to memory of 2524	5080	faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe	80
PID 2524 wrote to memory of 896	2524	explorku.exe	82
PID 2524 wrote to memory of 896	2524	explorku.exe	82
PID 2524 wrote to memory of 896	2524	explorku.exe	82
PID 2524 wrote to memory of 1332	2524	explorku.exe	83
PID 2524 wrote to memory of 1332	2524	explorku.exe	83
PID 2524 wrote to memory of 1332	2524	explorku.exe	83
PID 1332 wrote to memory of 2160	1332	amers.exe	84
PID 1332 wrote to memory of 2160	1332	amers.exe	84
PID 1332 wrote to memory of 2160	1332	amers.exe	84
PID 2524 wrote to memory of 232	2524	explorku.exe	85
PID 2524 wrote to memory of 232	2524	explorku.exe	85
PID 2524 wrote to memory of 232	2524	explorku.exe	85

C:\Users\Admin\AppData\Local\Temp\faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe
"C:\Users\Admin\AppData\Local\Temp\faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
  "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
    "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2160
- - C:\Users\Admin\1000006002\92ae20fbb9.exe
    "C:\Users\Admin\1000006002\92ae20fbb9.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    PID:232

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:916

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2848

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1000006002\92ae20fbb9.exe

Filesize
2.1MB

MD5
906505cc5818955f1793017c1d83206d

SHA1
21c7c8ff1b3cd6205d3018da9d449ff30b441db9

SHA256
9c3cdb46ca15b7c867ba2fdaab5f4c48e682ef004de8beac75d7da8186da3f1e

SHA512
d284c6819762a67058cbc1dc8803a787faec7adb68dd95f082d338882b61f616a40e8db5030d82820e3583a47d14b2ea19719b100c738a7ddd702b46a43f894d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

Filesize
1.8MB

MD5
387a60a7af32e4df90f96085e62eb63d

SHA1
38bcae57be5abec2a519810313b49d9d5fedfe24

SHA256
1b42d4086b500c28579921efe821bd8006d565f0dd40fdba961bda691e2e2973

SHA512
1b738060e7ff44657c75dffc7fe4767c77fef4744dfa94415b230796b4b27c6ac5015266bac57b2490c67ea84d961922ea55c192424575f48dbd6b6a40a55c51

Download Submit
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

Filesize
1.7MB

MD5
56f60bc166492f7e58b8e0d17c12ffe6

SHA1
1e297cbc6a7c3ab782ef00fadc6ad80318f234bf

SHA256
faa720d7dd7f20ffbcb0d38a9ca1f53eef426bff91477a47d1e80042c93fa390

SHA512
135db640c24fa83f440980889fd9880fbec358d164663584dc14ef9414b3c7193d29a6bbbb8f7fe19c58be4ff6753da8783fe5303411e13c2073cf3f4680ccaf

Download Submit
memory/232-92-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-90-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-86-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-91-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-87-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-85-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-89-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-88-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-84-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/232-95-0x0000000000940000-0x0000000000FB6000-memory.dmp

Filesize
6.5MB

Download
memory/916-106-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-109-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-103-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-111-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-107-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-102-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-108-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-105-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/916-104-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/1300-110-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/1300-113-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/1332-50-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/1332-51-0x00000000779D6000-0x00000000779D8000-memory.dmp

Filesize
8KB

Download
memory/1332-64-0x00000000006C0000-0x0000000000B7B000-memory.dmp

Filesize
4.7MB

Download
memory/2160-115-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-94-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-130-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-127-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-124-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-121-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-118-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-65-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-98-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2160-97-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2524-93-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-28-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-24-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-29-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-26-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-23-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-25-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-49-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-27-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-31-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-30-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2524-22-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/2848-142-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/2848-146-0x00000000007F0000-0x0000000000CAB000-memory.dmp

Filesize
4.7MB

Download
memory/5080-3-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-1-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-0-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-8-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-6-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-5-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-2-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-21-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-137-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/5080-136-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/5080-134-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/5080-135-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/5080-4-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download
memory/5080-144-0x0000000000120000-0x0000000000672000-memory.dmp

Filesize
5.3MB

Download
memory/5080-7-0x0000000000E60000-0x00000000013B2000-memory.dmp

Filesize
5.3MB

Download