amadey | 45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
Size

2.9MB
MD5

a916c16724e4aa3eef3839f1647f2b0f
SHA1

981069c2d4254ca1b9cf41bc5dab8db5bfda1558
SHA256

45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800
SHA512

dc4949109a56e0b177a266e3b30d7675a6af578af31e103dc5ca9a3e26da42c01b472b64cbe0b17c4c64890f477bfffc1a95bc256159ce7e112da20971448980
SSDEEP

49152:XYcTFPtXwQoLZUBwsfBvrDtWM2ztzbHm2HCoQVQBhm9vOVTU:vho9UBwsfBTDtW1ztHHmToQycvOVT

Score

10^/10

amadey 9c9aa5 discovery evasion execution trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4916	powershell.exe
4984	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Target.vbs	systemsound.exe

Executes dropped EXE 4 IoCs

pid	Process
2804	skotes.exe
2236	systemsound.exe
4836	20261eb00c.exe
2972	d50b5e9ad2.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	skotes.exe

Loads dropped DLL 9 IoCs

pid	Process
2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
2804	skotes.exe
2804	skotes.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2804	skotes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
2804	skotes.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	2236	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d50b5e9ad2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systemsound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20261eb00c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
2804	skotes.exe
4836	20261eb00c.exe
4916	powershell.exe
4984	powershell.exe
2236	systemsound.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	systemsound.exe
Token: SeDebugPrivilege	4836	20261eb00c.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	2236	systemsound.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2804	2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe	31
PID 2572 wrote to memory of 2804	2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe	31
PID 2572 wrote to memory of 2804	2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe	31
PID 2572 wrote to memory of 2804	2572	45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe	31
PID 2804 wrote to memory of 2236	2804	skotes.exe	34
PID 2804 wrote to memory of 2236	2804	skotes.exe	34
PID 2804 wrote to memory of 2236	2804	skotes.exe	34
PID 2804 wrote to memory of 2236	2804	skotes.exe	34
PID 2804 wrote to memory of 4836	2804	skotes.exe	35
PID 2804 wrote to memory of 4836	2804	skotes.exe	35
PID 2804 wrote to memory of 4836	2804	skotes.exe	35
PID 2804 wrote to memory of 4836	2804	skotes.exe	35
PID 4836 wrote to memory of 4916	4836	20261eb00c.exe	37
PID 4836 wrote to memory of 4916	4836	20261eb00c.exe	37
PID 4836 wrote to memory of 4916	4836	20261eb00c.exe	37
PID 4836 wrote to memory of 4916	4836	20261eb00c.exe	37
PID 4836 wrote to memory of 4984	4836	20261eb00c.exe	39
PID 4836 wrote to memory of 4984	4836	20261eb00c.exe	39
PID 4836 wrote to memory of 4984	4836	20261eb00c.exe	39
PID 4836 wrote to memory of 4984	4836	20261eb00c.exe	39
PID 2236 wrote to memory of 2344	2236	systemsound.exe	41
PID 2236 wrote to memory of 2344	2236	systemsound.exe	41
PID 2236 wrote to memory of 2344	2236	systemsound.exe	41
PID 2236 wrote to memory of 2344	2236	systemsound.exe	41
PID 2804 wrote to memory of 2972	2804	skotes.exe	42
PID 2804 wrote to memory of 2972	2804	skotes.exe	42
PID 2804 wrote to memory of 2972	2804	skotes.exe	42
PID 2804 wrote to memory of 2972	2804	skotes.exe	42

C:\Users\Admin\AppData\Local\Temp\45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe
"C:\Users\Admin\AppData\Local\Temp\45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800_Sigmanly.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe
    "C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 612
      4⤵
      Loads dropped DLL
      Program crash
      PID:2344
- - C:\Users\Admin\AppData\Local\Temp\1018820001\20261eb00c.exe
    "C:\Users\Admin\AppData\Local\Temp\1018820001\20261eb00c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\tslcudfqob"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4984
- - C:\Users\Admin\AppData\Local\Temp\1018821001\d50b5e9ad2.exe
    "C:\Users\Admin\AppData\Local\Temp\1018821001\d50b5e9ad2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1018586001\KDLBJP7.exe

Filesize
1.5MB

MD5
fe9044b6b71ab4f7ee9475891acbb2ca

SHA1
17539df3e0478729b61b1f6e82426ad47f05391f

SHA256
366abe07779080156c246b2e63efe87895d00c7ef76853aaa5fa4e0c9af0d993

SHA512
4558c1dc662efa4096a7e4e7affabc97cbe364d39c0aef0c45f6a7b2ae48c80108c291887c5581daea066bbb5f9566097ad38900f3f81a8f7f5e2ed1a6cda5eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018676001\systemsound.exe

Filesize
1.2MB

MD5
b5c16c628277965fd1fb8fead07b149d

SHA1
cf25269a9896c550ae73eb4c71c2080d0273553a

SHA256
fbaf4ce60142ad358be5fcbf6545462d24053982161606e5212203ecfc733d27

SHA512
35a92b04c2e7879d0c7605f173a86b7cf83689f8fa2cf9ccda6cb236ec10f845c9626f6028858e23cc7240fabb860538da25b40eb415151eae13a1b116ad278b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018820001\20261eb00c.exe

Filesize
21KB

MD5
14becdf1e2402e9aa6c2be0e6167041e

SHA1
72cbbae6878f5e06060a0038b25ede93b445f0df

SHA256
7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

SHA512
16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018821001\d50b5e9ad2.exe

Filesize
1.0MB

MD5
7622bc8aafebb69b7ad6c9a4a17e11c6

SHA1
a9ceb928cb0c7618870c23b07bfdba059da53f48

SHA256
d2c8cd3c2a42968d9c92932810bb762fb02be4cbf1641b0918ee8e5b0171d845

SHA512
6b15a5274348599a286b80e97cccc4fc79a3b4853b388995ab93d8393737d3e8f4783037de9776a0d8345bc73b0c1cd15e19a6d05222d181470335c900230160

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
a916c16724e4aa3eef3839f1647f2b0f

SHA1
981069c2d4254ca1b9cf41bc5dab8db5bfda1558

SHA256
45400639f60d98c903e3942bea79413d9779bb1a62d96ffe1ac621de8dbd3800

SHA512
dc4949109a56e0b177a266e3b30d7675a6af578af31e103dc5ca9a3e26da42c01b472b64cbe0b17c4c64890f477bfffc1a95bc256159ce7e112da20971448980

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b8e896755216745634cf2d0fd435908e

SHA1
7e693072272bece3cfef7a68b34ccf3c0e420720

SHA256
69f712eed175ea96d9f1b767de1bb2d6c580f5c5a7d7a15e3a59ee34f38c290b

SHA512
fc31c61798841d0a8cd8f2f5c61a0438fba19924b9343abf24e0a6182f2c7a6336b65a97a2ef4880721b6697980e7465e9381304137f2bb632d92e53afc7c78f

Download Submit
memory/2236-96-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-98-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-1264-0x0000000002190000-0x00000000021E4000-memory.dmp

Filesize
336KB

Download
memory/2236-114-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-66-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-1240-0x0000000001F30000-0x0000000001F7C000-memory.dmp

Filesize
304KB

Download
memory/2236-1239-0x00000000044B0000-0x000000000453A000-memory.dmp

Filesize
552KB

Download
memory/2236-70-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-72-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-74-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-76-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-82-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-84-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-86-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-90-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-93-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-94-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-116-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-100-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-102-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-104-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-106-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-108-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-61-0x00000000009F0000-0x0000000000B24000-memory.dmp

Filesize
1.2MB

Download
memory/2236-62-0x0000000004BF0000-0x0000000004D08000-memory.dmp

Filesize
1.1MB

Download
memory/2236-80-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-63-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-64-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-110-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-112-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-68-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-78-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2236-88-0x0000000004BF0000-0x0000000004D03000-memory.dmp

Filesize
1.1MB

Download
memory/2572-2-0x0000000000BA1000-0x0000000000BCF000-memory.dmp

Filesize
184KB

Download
memory/2572-0-0x0000000000BA0000-0x0000000000EBB000-memory.dmp

Filesize
3.1MB

Download
memory/2572-1-0x0000000077AE0000-0x0000000077AE2000-memory.dmp

Filesize
8KB

Download
memory/2572-4-0x0000000000BA0000-0x0000000000EBB000-memory.dmp

Filesize
3.1MB

Download
memory/2572-5-0x0000000000BA0000-0x0000000000EBB000-memory.dmp

Filesize
3.1MB

Download
memory/2572-16-0x0000000006750000-0x0000000006A6B000-memory.dmp

Filesize
3.1MB

Download
memory/2572-15-0x0000000000BA0000-0x0000000000EBB000-memory.dmp

Filesize
3.1MB

Download
memory/2572-3-0x0000000000BA0000-0x0000000000EBB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-29-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-25-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-32-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-31-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-30-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-21-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-28-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-27-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-26-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-33-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-23-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-24-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-19-0x00000000011A1000-0x00000000011CF000-memory.dmp

Filesize
184KB

Download
memory/2804-20-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-34-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-18-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-35-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/2804-36-0x00000000011A0000-0x00000000014BB000-memory.dmp

Filesize
3.1MB

Download
memory/4836-1255-0x00000000013C0000-0x00000000013CC000-memory.dmp

Filesize
48KB

Download