amadey | d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
Size

3.0MB
MD5

ad7f121646aa374af133772519375710
SHA1

4e85ad004aa170ed53b7818b78e0b12e042b18ea
SHA256

d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f
SHA512

fbe1dfd40bc2fa8c6617823d32023dba5625c5e7cb235f87b284f1166a30d64e75781e80b2586e4a6f7ada4cda9df3e17f1d61829705647c71232a2f902c81c3
SSDEEP

49152:6UAh2jV6Tj3t5FH+2Qy0GsO7wXRzFxa73lx5:6UAh2jVej3jFH+2QyQO7ghO35

Score

10^/10

amadey 9c9aa5 discovery evasion ransomware trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Renames multiple (8179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Executes dropped EXE 2 IoCs

pid	Process
2736	skotes.exe
1756	4ZD5C3i.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	skotes.exe

Loads dropped DLL 4 IoCs

pid	Process
2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
2736	skotes.exe
2736	skotes.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	4ZD5C3i.exe
File opened (read-only)	\??\Z:	4ZD5C3i.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
2736	skotes.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232803.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_COL.HXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00345_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BORDERBB.DPV	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt	4ZD5C3i.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	4ZD5C3i.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15023_.GIF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN086.XML	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN020.XML	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02066_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01797_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0229385.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01474_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287024.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist	4ZD5C3i.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105974.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107730.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA0009.DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00915_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105280.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar	4ZD5C3i.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00720_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml	4ZD5C3i.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\SPACER.GIF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jvm.hprof.txt	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01069_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00168_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9B.GIF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199609.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02091_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18242_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\psfont.properties.ja	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\APA.XSL	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Recife	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem	4ZD5C3i.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll	4ZD5C3i.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ZD5C3i.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
2736	skotes.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe
1756	4ZD5C3i.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1756	4ZD5C3i.exe
Token: SeBackupPrivilege	2428	vssvc.exe
Token: SeRestorePrivilege	2428	vssvc.exe
Token: SeAuditPrivilege	2428	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2736	2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe	30
PID 2916 wrote to memory of 2736	2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe	30
PID 2916 wrote to memory of 2736	2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe	30
PID 2916 wrote to memory of 2736	2916	d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe	30
PID 2736 wrote to memory of 1756	2736	skotes.exe	32
PID 2736 wrote to memory of 1756	2736	skotes.exe	32
PID 2736 wrote to memory of 1756	2736	skotes.exe	32
PID 2736 wrote to memory of 1756	2736	skotes.exe	32

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
"C:\Users\Admin\AppData\Local\Temp\d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe
    "C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\README.TXT

Filesize
533B

MD5
81d185495b4e6430a87dfd37789bb872

SHA1
b5da653f81a548c74205c7ae3d19f30af1a14271

SHA256
838d654b9cb0360d8b3bb767db8fc1954fc41ba0a56fc34688aad9b50f5ddb40

SHA512
1106c9c2245cbd44effb42e4e1365eb796d3b2390b011fb97205550bf183b097c489194aa001f97f949e9d1ed1c970eea6cbb0477da47511e5bc18e88bf2dfa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe

Filesize
1.1MB

MD5
42a8588cc82773cd223c42f8fe4be91a

SHA1
e2ed3cda00140ecd445f5f742729d34f2c452c8c

SHA256
d4521c34f489f4a6065dea15634df9bb700c84741f476bde1084d9cdfb373a7b

SHA512
681e4b155ce1015723469bd819618b292844aa00f7dab447d9557e244792efcef5614f753283efe9dd76ea77b838af78a3e69008c380482a4412b1cea75c535d

Download Submit
\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.0MB

MD5
ad7f121646aa374af133772519375710

SHA1
4e85ad004aa170ed53b7818b78e0b12e042b18ea

SHA256
d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f

SHA512
fbe1dfd40bc2fa8c6617823d32023dba5625c5e7cb235f87b284f1166a30d64e75781e80b2586e4a6f7ada4cda9df3e17f1d61829705647c71232a2f902c81c3

Download Submit
memory/2736-17292-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17300-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17301-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-47-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17299-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17298-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-49-0x0000000000341000-0x00000000003A9000-memory.dmp

Filesize
416KB

Download
memory/2736-19-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-24-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-23-0x0000000000341000-0x00000000003A9000-memory.dmp

Filesize
416KB

Download
memory/2736-26-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-27-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17297-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-45-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17302-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17296-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17295-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-48-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17294-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-3555-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-10663-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2736-17293-0x0000000000340000-0x000000000064E000-memory.dmp

Filesize
3.1MB

Download
memory/2916-0-0x0000000000DD0000-0x00000000010DE000-memory.dmp

Filesize
3.1MB

Download
memory/2916-1-0x0000000077A70000-0x0000000077A72000-memory.dmp

Filesize
8KB

Download
memory/2916-20-0x0000000006B00000-0x0000000006E0E000-memory.dmp

Filesize
3.1MB

Download
memory/2916-5-0x0000000000DD0000-0x00000000010DE000-memory.dmp

Filesize
3.1MB

Download
memory/2916-2-0x0000000000DD1000-0x0000000000E39000-memory.dmp

Filesize
416KB

Download
memory/2916-17-0x0000000000DD0000-0x00000000010DE000-memory.dmp

Filesize
3.1MB

Download
memory/2916-21-0x0000000006B00000-0x0000000006E0E000-memory.dmp

Filesize
3.1MB

Download
memory/2916-22-0x0000000000DD1000-0x0000000000E39000-memory.dmp

Filesize
416KB

Download
memory/2916-3-0x0000000000DD0000-0x00000000010DE000-memory.dmp

Filesize
3.1MB

Download
memory/2916-46-0x0000000006B00000-0x0000000006E0E000-memory.dmp

Filesize
3.1MB

Download