amadey | 4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
Size

1.8MB
MD5

38997f01ec95ad2671690520309a2eca
SHA1

46f96a154b8a943206ee816a7e6391d2dd1a2c36
SHA256

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be
SHA512

346b3b9ea8fb8480ad5a23d60853074cb41dd61f2fdf4a2f15e127b487c9a3e69ff1cd73f16a6082c6d1d3ab76ac6cf19abce1084fc8776029741c62f4355797
SSDEEP

49152:j3JPrINSEEVs5e3JQC7VSw6h2r4pZioF+s5m2VD4z:j5Pr0yVsOQC796h2r4pZiwX

Score

10^/10

amadey lumma stealc fed3aa tale discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

http://185.215.113.206

Attributes

url_path
/6c4adf523b719729.php

Extracted

Family

lumma

https://necklacedmny.store/api

https://founpiuer.store/api

https://navygenerayk.store/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ad30b191f2.exeaxplong.exeaxplong.exeaxplong.exe4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exeaxplong.exe0575e2d289.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ad30b191f2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0575e2d289.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exeaxplong.exe0575e2d289.exeaxplong.exeaxplong.exeaxplong.exead30b191f2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0575e2d289.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0575e2d289.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ad30b191f2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ad30b191f2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exeaxplong.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	axplong.exe

Executes dropped EXE 6 IoCs

Processes:

axplong.exe0575e2d289.exead30b191f2.exeaxplong.exeaxplong.exeaxplong.exe

pid process

2508 axplong.exe
2628 0575e2d289.exe
2640 ad30b191f2.exe
2444 axplong.exe
2804 axplong.exe
760 axplong.exe

pid	process
2508	axplong.exe
2628	0575e2d289.exe
2640	ad30b191f2.exe
2444	axplong.exe
2804	axplong.exe
760	axplong.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exe0575e2d289.exead30b191f2.exeaxplong.exeaxplong.exeaxplong.exe4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	0575e2d289.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	ad30b191f2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

axplong.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0575e2d289.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001263001\\0575e2d289.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ad30b191f2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001264001\\ad30b191f2.exe"	axplong.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exeaxplong.exe0575e2d289.exead30b191f2.exeaxplong.exeaxplong.exeaxplong.exe

pid	process
1124	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
2508	axplong.exe
2628	0575e2d289.exe
2640	ad30b191f2.exe
2444	axplong.exe
2804	axplong.exe
760	axplong.exe

Drops file in Windows directory 1 IoCs

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe

description ioc process

File created C:\Windows\Tasks\axplong.job 4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exeaxplong.exe0575e2d289.exead30b191f2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0575e2d289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad30b191f2.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exeaxplong.exe0575e2d289.exead30b191f2.exeaxplong.exeaxplong.exeaxplong.exe

pid	process
1124	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
1124	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
2508	axplong.exe
2508	axplong.exe
2628	0575e2d289.exe
2628	0575e2d289.exe
2640	ad30b191f2.exe
2640	ad30b191f2.exe
2444	axplong.exe
2444	axplong.exe
2804	axplong.exe
2804	axplong.exe
760	axplong.exe
760	axplong.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe

pid process

1124 4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exeaxplong.exe

description	pid	process	target process
PID 1124 wrote to memory of 2508	1124	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe	axplong.exe
PID 1124 wrote to memory of 2508	1124	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe	axplong.exe
PID 1124 wrote to memory of 2508	1124	4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe	axplong.exe
PID 2508 wrote to memory of 2628	2508	axplong.exe	0575e2d289.exe
PID 2508 wrote to memory of 2628	2508	axplong.exe	0575e2d289.exe
PID 2508 wrote to memory of 2628	2508	axplong.exe	0575e2d289.exe
PID 2508 wrote to memory of 2640	2508	axplong.exe	ad30b191f2.exe
PID 2508 wrote to memory of 2640	2508	axplong.exe	ad30b191f2.exe
PID 2508 wrote to memory of 2640	2508	axplong.exe	ad30b191f2.exe

C:\Users\Admin\AppData\Local\Temp\4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe
"C:\Users\Admin\AppData\Local\Temp\4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1124

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508

C:\Users\Admin\AppData\Local\Temp\1001263001\0575e2d289.exe
"C:\Users\Admin\AppData\Local\Temp\1001263001\0575e2d289.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2628

C:\Users\Admin\AppData\Local\Temp\1001264001\ad30b191f2.exe
"C:\Users\Admin\AppData\Local\Temp\1001264001\ad30b191f2.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2640

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2444

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2804

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1001263001\0575e2d289.exe

Filesize
2.0MB

MD5
db6b1432e0641f3ec061401d5547d4a4

SHA1
b037de812f635be7e0ce633785cb356f04f36301

SHA256
9112846b3c122fd59a75c3b60e1821e81e90700948dbff182ac8f38263fc78dc

SHA512
9e581521cb120bac3410b13a3f53c0f4a852a3eddd2468837afb88574d2feb1c3b60d76292a4e0ad040e8b0bd448db60652577c771d2247e7cc0c835d6f25a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001264001\ad30b191f2.exe

Filesize
2.8MB

MD5
de54690c9f171f91b13960453ab60fd3

SHA1
670b2988eca93c82e2639960fd638ee5d56f34d6

SHA256
51961e496e66b300950023c9aba682a5232ade37926db00f10e58df4f46eb1cd

SHA512
3b14a96e738433b089d3923f7d89f33734ea4a7e004cea56be60845c798a693a1417a022cfa5a3725a42c35625aaec6e60b1ecf5260a3a7cf6935a62dd1ce9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
38997f01ec95ad2671690520309a2eca

SHA1
46f96a154b8a943206ee816a7e6391d2dd1a2c36

SHA256
4d4a35df34a61bb4628cdf800789b71e9ff45f097941cd37dce9edf4767b19be

SHA512
346b3b9ea8fb8480ad5a23d60853074cb41dd61f2fdf4a2f15e127b487c9a3e69ff1cd73f16a6082c6d1d3ab76ac6cf19abce1084fc8776029741c62f4355797

Download Submit
memory/760-82-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/1124-1-0x0000000076ED4000-0x0000000076ED6000-memory.dmp

Filesize
8KB

Download
memory/1124-2-0x0000000000691000-0x00000000006BF000-memory.dmp

Filesize
184KB

Download
memory/1124-3-0x0000000000690000-0x0000000000B38000-memory.dmp

Filesize
4.7MB

Download
memory/1124-4-0x0000000000690000-0x0000000000B38000-memory.dmp

Filesize
4.7MB

Download
memory/1124-17-0x0000000000690000-0x0000000000B38000-memory.dmp

Filesize
4.7MB

Download
memory/1124-0-0x0000000000690000-0x0000000000B38000-memory.dmp

Filesize
4.7MB

Download
memory/2444-65-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2444-64-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-71-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-77-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-18-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-80-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-41-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-42-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-43-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-79-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-78-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-75-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-62-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-21-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-20-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-66-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-67-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-68-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-69-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-70-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-19-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2508-76-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2628-37-0x00000000001D0000-0x00000000008FA000-memory.dmp

Filesize
7.2MB

Download
memory/2628-38-0x00000000001D0000-0x00000000008FA000-memory.dmp

Filesize
7.2MB

Download
memory/2628-40-0x00000000001D0000-0x00000000008FA000-memory.dmp

Filesize
7.2MB

Download
memory/2628-39-0x00000000001D0000-0x00000000008FA000-memory.dmp

Filesize
7.2MB

Download
memory/2640-61-0x00000000001A0000-0x00000000004AD000-memory.dmp

Filesize
3.1MB

Download
memory/2640-59-0x00000000001A0000-0x00000000004AD000-memory.dmp

Filesize
3.1MB

Download
memory/2804-74-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download
memory/2804-73-0x00000000005C0000-0x0000000000A68000-memory.dmp

Filesize
4.7MB

Download