amadey | 04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Size

1.8MB
MD5

62d6cdcfcde3d804e9dc54fb5035c97e
SHA1

1a77368b63179759bc20b54dd1e8acd422c21297
SHA256

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a
SHA512

8735499eb8af7f1566fc40d900f270c238a6cc02a7d49b6e98b446647260f19f6886ce718183d85c5c5f8c3d07103be17458058c32c4d0b117be65dd6d71a9dd
SSDEEP

49152:tmxnB4iwvGcekoEswmraq08JDd7LcOF8JAJNGBi:0P4B3QENmTZ/LP0YIi

Score

10^/10

amadey lumma fed3aa discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

https://navygenerayk.store/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exe04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exeaxplong.exe03f8c457c7.exe8130dd6f6c.exeaxplong.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	03f8c457c7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8130dd6f6c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe8130dd6f6c.exeaxplong.exeaxplong.exeaxplong.exe03f8c457c7.exeaxplong.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8130dd6f6c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	03f8c457c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8130dd6f6c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	03f8c457c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exeaxplong.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	axplong.exe

Executes dropped EXE 6 IoCs

Processes:

axplong.exe03f8c457c7.exe8130dd6f6c.exeaxplong.exeaxplong.exeaxplong.exe

pid process

2280 axplong.exe
3628 03f8c457c7.exe
3828 8130dd6f6c.exe
4816 axplong.exe
4748 axplong.exe
4888 axplong.exe

pid	process
2280	axplong.exe
3628	03f8c457c7.exe
3828	8130dd6f6c.exe
4816	axplong.exe
4748	axplong.exe
4888	axplong.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exeaxplong.exeaxplong.exe04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exeaxplong.exe03f8c457c7.exe8130dd6f6c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	03f8c457c7.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine	8130dd6f6c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

axplong.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\03f8c457c7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002655001\\03f8c457c7.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8130dd6f6c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002656001\\8130dd6f6c.exe"	axplong.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exeaxplong.exe03f8c457c7.exe8130dd6f6c.exeaxplong.exeaxplong.exeaxplong.exe

pid	process
2124	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
2280	axplong.exe
3628	03f8c457c7.exe
3828	8130dd6f6c.exe
4816	axplong.exe
4748	axplong.exe
4888	axplong.exe

Drops file in Windows directory 1 IoCs

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe

description ioc process

File created C:\Windows\Tasks\axplong.job 04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exeaxplong.exe03f8c457c7.exe8130dd6f6c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03f8c457c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8130dd6f6c.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exeaxplong.exe03f8c457c7.exe8130dd6f6c.exeaxplong.exeaxplong.exeaxplong.exe

pid	process
2124	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
2124	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
2280	axplong.exe
2280	axplong.exe
3628	03f8c457c7.exe
3628	03f8c457c7.exe
3828	8130dd6f6c.exe
3828	8130dd6f6c.exe
4816	axplong.exe
4816	axplong.exe
4748	axplong.exe
4748	axplong.exe
4888	axplong.exe
4888	axplong.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe

pid process

2124 04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exeaxplong.exe

description	pid	process	target process
PID 2124 wrote to memory of 2280	2124	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe	axplong.exe
PID 2124 wrote to memory of 2280	2124	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe	axplong.exe
PID 2124 wrote to memory of 2280	2124	04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe	axplong.exe
PID 2280 wrote to memory of 3628	2280	axplong.exe	03f8c457c7.exe
PID 2280 wrote to memory of 3628	2280	axplong.exe	03f8c457c7.exe
PID 2280 wrote to memory of 3628	2280	axplong.exe	03f8c457c7.exe
PID 2280 wrote to memory of 3828	2280	axplong.exe	8130dd6f6c.exe
PID 2280 wrote to memory of 3828	2280	axplong.exe	8130dd6f6c.exe
PID 2280 wrote to memory of 3828	2280	axplong.exe	8130dd6f6c.exe

C:\Users\Admin\AppData\Local\Temp\04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe
"C:\Users\Admin\AppData\Local\Temp\04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Users\Admin\AppData\Local\Temp\1002655001\03f8c457c7.exe
    "C:\Users\Admin\AppData\Local\Temp\1002655001\03f8c457c7.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\1002656001\8130dd6f6c.exe
    "C:\Users\Admin\AppData\Local\Temp\1002656001\8130dd6f6c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3828

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4816

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4748

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1002655001\03f8c457c7.exe

Filesize
1.8MB

MD5
ce0d32a95fc1664e16f7ccd44d3f073d

SHA1
6f7b857af32c1d31b2f55066538d5c53fe2d4c94

SHA256
0822c1dabf569f61af0bfad15d5432829aa1c884918cd3b80a958d3310fdaacb

SHA512
99d9c5251c7d7a809a22d21d68171d59778c24098c9313f0274f995693d415ade9b6d9535a6791f8cb752ff4b4d279e19d19983f7906ad46a51beb4bf513c5c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002656001\8130dd6f6c.exe

Filesize
3.0MB

MD5
34996e43343bedadada4ff31ccbeb2a7

SHA1
c1999a215004f697ded26c9ec6a3393e964e0e2d

SHA256
9a0b1888194e6e3e04dce5a6ce91b1fa8e847feecf42e0a0670bcef89d342486

SHA512
b11c46cd22848066b4dd6c321548b78abafcb1feacefbf35602cc822701f38040ab9fd0942d4650f0e3670af891b21a4fd44778993789f990f24eaa9e88d6f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
62d6cdcfcde3d804e9dc54fb5035c97e

SHA1
1a77368b63179759bc20b54dd1e8acd422c21297

SHA256
04c93a65a63a06f199393045827a3d597942b9168e49dd608b9b8182fb6e2b2a

SHA512
8735499eb8af7f1566fc40d900f270c238a6cc02a7d49b6e98b446647260f19f6886ce718183d85c5c5f8c3d07103be17458058c32c4d0b117be65dd6d71a9dd

Download Submit
memory/2124-1-0x0000000077AC4000-0x0000000077AC6000-memory.dmp

Filesize
8KB

Download
memory/2124-2-0x0000000000611000-0x000000000063F000-memory.dmp

Filesize
184KB

Download
memory/2124-3-0x0000000000610000-0x0000000000AC1000-memory.dmp

Filesize
4.7MB

Download
memory/2124-4-0x0000000000610000-0x0000000000AC1000-memory.dmp

Filesize
4.7MB

Download
memory/2124-0-0x0000000000610000-0x0000000000AC1000-memory.dmp

Filesize
4.7MB

Download
memory/2124-18-0x0000000000610000-0x0000000000AC1000-memory.dmp

Filesize
4.7MB

Download
memory/2280-60-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-67-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-22-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-20-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-85-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-81-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-80-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-79-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-43-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-19-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-78-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-16-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-77-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-62-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-63-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-76-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-72-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-21-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-68-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-69-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-70-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/2280-71-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/3628-42-0x0000000000440000-0x0000000000AEE000-memory.dmp

Filesize
6.7MB

Download
memory/3628-40-0x0000000000440000-0x0000000000AEE000-memory.dmp

Filesize
6.7MB

Download
memory/3628-39-0x0000000000441000-0x0000000000458000-memory.dmp

Filesize
92KB

Download
memory/3628-38-0x0000000000440000-0x0000000000AEE000-memory.dmp

Filesize
6.7MB

Download
memory/3828-61-0x0000000000070000-0x000000000036F000-memory.dmp

Filesize
3.0MB

Download
memory/3828-59-0x0000000000070000-0x000000000036F000-memory.dmp

Filesize
3.0MB

Download
memory/4748-74-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/4748-75-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/4816-66-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/4816-65-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/4888-83-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download
memory/4888-84-0x00000000001E0000-0x0000000000691000-memory.dmp

Filesize
4.7MB

Download