amadey | 9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845

Analysis

max time kernel
141s
max time network
107s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
10-04-2023 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe
Size

939KB
MD5

b2ea987c7a7cab74ed6af78782155d0c
SHA1

ee9cab6e043da026d2971effb1c4f1a2c82127ee
SHA256

9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845
SHA512

25ae5f37ea03adef30ad4158b2457f7433ed379d2aa88a7e7f3d8f42c80e4157b28e0269e17e21ed87e63e1de7c522562368448f4cf2857a73b307d08e007263
SSDEEP

24576:dynNlZHj1wkMGKSic9l4d4efIjtdtfgJCZ4w:4nNlFZyA4d398Z

Score

10^/10

amadey redline rosn zima discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

pr915141.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr915141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr915141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr915141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr915141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr915141.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4852-184-0x0000000002280000-0x00000000022C6000-memory.dmp	family_redline
behavioral1/memory/4852-185-0x0000000004F60000-0x0000000004FA4000-memory.dmp	family_redline
behavioral1/memory/4852-186-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-187-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-189-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-191-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-193-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-195-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-197-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-199-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-201-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-203-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-205-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-207-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-209-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-211-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-213-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-215-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-218-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline
behavioral1/memory/4852-222-0x0000000004F60000-0x0000000004F9F000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

un609354.exeun992045.exepr915141.exequ856030.exerk508861.exesi019478.exe

pid process

3960 un609354.exe
4900 un992045.exe
3500 pr915141.exe
4852 qu856030.exe
4404 rk508861.exe
3772 si019478.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3960	un609354.exe
4900	un992045.exe
3500	pr915141.exe
4852	qu856030.exe
4404	rk508861.exe
3772	si019478.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pr915141.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr915141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr915141.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

un609354.exeun992045.exe9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un609354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un609354.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un992045.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un992045.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3784	3772	WerFault.exe	si019478.exe
3032	3772	WerFault.exe	si019478.exe
4300	3772	WerFault.exe	si019478.exe
4392	3772	WerFault.exe	si019478.exe
1556	3772	WerFault.exe	si019478.exe
4676	3772	WerFault.exe	si019478.exe
4688	3772	WerFault.exe	si019478.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

pr915141.exequ856030.exerk508861.exe

pid process

3500 pr915141.exe
3500 pr915141.exe
4852 qu856030.exe
4852 qu856030.exe
4404 rk508861.exe
4404 rk508861.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

pr915141.exequ856030.exerk508861.exe

description pid process

Token: SeDebugPrivilege 3500 pr915141.exe
Token: SeDebugPrivilege 4852 qu856030.exe
Token: SeDebugPrivilege 4404 rk508861.exe

pid	process
3500	pr915141.exe
3500	pr915141.exe
4852	qu856030.exe
4852	qu856030.exe
4404	rk508861.exe
4404	rk508861.exe

description	pid	process
Token: SeDebugPrivilege	3500	pr915141.exe
Token: SeDebugPrivilege	4852	qu856030.exe
Token: SeDebugPrivilege	4404	rk508861.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exeun609354.exeun992045.exe

description	pid	process	target process
PID 3704 wrote to memory of 3960	3704	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe	un609354.exe
PID 3704 wrote to memory of 3960	3704	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe	un609354.exe
PID 3704 wrote to memory of 3960	3704	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe	un609354.exe
PID 3960 wrote to memory of 4900	3960	un609354.exe	un992045.exe
PID 3960 wrote to memory of 4900	3960	un609354.exe	un992045.exe
PID 3960 wrote to memory of 4900	3960	un609354.exe	un992045.exe
PID 4900 wrote to memory of 3500	4900	un992045.exe	pr915141.exe
PID 4900 wrote to memory of 3500	4900	un992045.exe	pr915141.exe
PID 4900 wrote to memory of 3500	4900	un992045.exe	pr915141.exe
PID 4900 wrote to memory of 4852	4900	un992045.exe	qu856030.exe
PID 4900 wrote to memory of 4852	4900	un992045.exe	qu856030.exe
PID 4900 wrote to memory of 4852	4900	un992045.exe	qu856030.exe
PID 3960 wrote to memory of 4404	3960	un609354.exe	rk508861.exe
PID 3960 wrote to memory of 4404	3960	un609354.exe	rk508861.exe
PID 3960 wrote to memory of 4404	3960	un609354.exe	rk508861.exe
PID 3704 wrote to memory of 3772	3704	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe	si019478.exe
PID 3704 wrote to memory of 3772	3704	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe	si019478.exe
PID 3704 wrote to memory of 3772	3704	9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe	si019478.exe

C:\Users\Admin\AppData\Local\Temp\9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe
"C:\Users\Admin\AppData\Local\Temp\9263cb167a13835ce4e9a823ceb0d9174db935c672dd5c396e1c95e4a1d0b845.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un609354.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un609354.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un992045.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un992045.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr915141.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr915141.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu856030.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu856030.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4852
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk508861.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk508861.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si019478.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si019478.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 616
    3⤵
    - Program crash
    PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 696
    3⤵
    - Program crash
    PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 836
    3⤵
    - Program crash
    PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 848
    3⤵
    - Program crash
    PID:4392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 876
    3⤵
    - Program crash
    PID:1556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 736
    3⤵
    - Program crash
    PID:4676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 1060
    3⤵
    - Program crash
    PID:4688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si019478.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si019478.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un609354.exe

Filesize
674KB

MD5
dbedb4560fe2f00eabe1ae8f0181428e

SHA1
4a4a0d8c64a6705238c95a19b223f4b4bf27f202

SHA256
36f137cbbed5ca16f4aef1ef2bb7a6d5905776f5cc0aa61da81a7f7c0ed2728e

SHA512
4c70169dc88c8fc47b646790d8602745da72993bbdcb5cc907655ecd8a09ebd264ef86abaf9259770cdfac2e2fdb03061645efc2bc244da249303b55d50e7996

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un609354.exe

Filesize
674KB

MD5
dbedb4560fe2f00eabe1ae8f0181428e

SHA1
4a4a0d8c64a6705238c95a19b223f4b4bf27f202

SHA256
36f137cbbed5ca16f4aef1ef2bb7a6d5905776f5cc0aa61da81a7f7c0ed2728e

SHA512
4c70169dc88c8fc47b646790d8602745da72993bbdcb5cc907655ecd8a09ebd264ef86abaf9259770cdfac2e2fdb03061645efc2bc244da249303b55d50e7996

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk508861.exe

Filesize
168KB

MD5
c84141b109ea9992223229390fe4c2a5

SHA1
976c4ada3637fcd9dc362a0925a8a313c6fe1ce6

SHA256
1ab1185ae1b2c7b77724075acfb7cd634c8c2b30ce9ab5614f05834d35da55dc

SHA512
f8b6a5490c050b2d39c4a255e3621e8d418c0dc981e9be2759300fc87285d31fd74228c955efd0d6dc617fbcabd51d6fcbd1a0354e6626bd644245686dea4a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk508861.exe

Filesize
168KB

MD5
c84141b109ea9992223229390fe4c2a5

SHA1
976c4ada3637fcd9dc362a0925a8a313c6fe1ce6

SHA256
1ab1185ae1b2c7b77724075acfb7cd634c8c2b30ce9ab5614f05834d35da55dc

SHA512
f8b6a5490c050b2d39c4a255e3621e8d418c0dc981e9be2759300fc87285d31fd74228c955efd0d6dc617fbcabd51d6fcbd1a0354e6626bd644245686dea4a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un992045.exe

Filesize
520KB

MD5
976ed87be5638e0d7b8e319f18b14dfb

SHA1
18372861746d465839f5dd2ddd4caa80a8820333

SHA256
76eb9745c43a04eccec860e68ec2fe471fca9ec6d67b13ef722f02c627bb40ee

SHA512
a9af2b2f6ac291f4f6426a5fcefb669e6383396c06474235f3ee36d53aacdaf1fafdf3bcb8f55b968e275fabe4a190e762ba26ae4fbeb0b470efc5d403f7a4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un992045.exe

Filesize
520KB

MD5
976ed87be5638e0d7b8e319f18b14dfb

SHA1
18372861746d465839f5dd2ddd4caa80a8820333

SHA256
76eb9745c43a04eccec860e68ec2fe471fca9ec6d67b13ef722f02c627bb40ee

SHA512
a9af2b2f6ac291f4f6426a5fcefb669e6383396c06474235f3ee36d53aacdaf1fafdf3bcb8f55b968e275fabe4a190e762ba26ae4fbeb0b470efc5d403f7a4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr915141.exe

Filesize
239KB

MD5
8933514113ef23af43a5875a350f7855

SHA1
f5ee7b60122e9131e2e2aa8237f8ecdc90933d67

SHA256
b6976b378a033a38e4df5f137041a055f4aca6739c3ff8cb207417018693d905

SHA512
17ada4445d7901648427ac9489e1fbb7c69d768cb05c49d3fc2c6c958adbab66e211fb54ecef8a776ab216eb3b610be6825437df1fe924a5ecaeac07fb2c9f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr915141.exe

Filesize
239KB

MD5
8933514113ef23af43a5875a350f7855

SHA1
f5ee7b60122e9131e2e2aa8237f8ecdc90933d67

SHA256
b6976b378a033a38e4df5f137041a055f4aca6739c3ff8cb207417018693d905

SHA512
17ada4445d7901648427ac9489e1fbb7c69d768cb05c49d3fc2c6c958adbab66e211fb54ecef8a776ab216eb3b610be6825437df1fe924a5ecaeac07fb2c9f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu856030.exe

Filesize
297KB

MD5
af53c79a0d55d35389993b9f57f6e316

SHA1
95beb7c0fa6eb6867d3ed6a62034a954484d713f

SHA256
24f20e9a8f75234a8bf5d09d55528d79e29d240a5515c3c4a14eab05654c0aa3

SHA512
49057fc95790175c99746f67af2cf3973557a598ff1108fcd3a9193cb006ffd86fe136ffa2822620f46dcf89b8d6425732af8dcc12a9a2735e8554ec19fad20d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu856030.exe

Filesize
297KB

MD5
af53c79a0d55d35389993b9f57f6e316

SHA1
95beb7c0fa6eb6867d3ed6a62034a954484d713f

SHA256
24f20e9a8f75234a8bf5d09d55528d79e29d240a5515c3c4a14eab05654c0aa3

SHA512
49057fc95790175c99746f67af2cf3973557a598ff1108fcd3a9193cb006ffd86fe136ffa2822620f46dcf89b8d6425732af8dcc12a9a2735e8554ec19fad20d

Download Submit
memory/3500-156-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-179-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3500-145-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-146-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-148-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-150-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-152-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-154-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-141-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/3500-158-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-160-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-162-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3500-163-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-164-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3500-167-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-166-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3500-169-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-171-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-173-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-175-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/3500-176-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3500-178-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3500-144-0x00000000049D0000-0x00000000049E8000-memory.dmp

Filesize
96KB

Download
memory/3500-142-0x0000000002030000-0x000000000204A000-memory.dmp

Filesize
104KB

Download
memory/3500-143-0x0000000004B20000-0x000000000501E000-memory.dmp

Filesize
5.0MB

Download
memory/3772-1127-0x0000000000590000-0x00000000005CB000-memory.dmp

Filesize
236KB

Download
memory/4404-1117-0x0000000000860000-0x0000000000890000-memory.dmp

Filesize
192KB

Download
memory/4404-1121-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/4404-1118-0x00000000029D0000-0x00000000029D6000-memory.dmp

Filesize
24KB

Download
memory/4404-1120-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/4404-1119-0x000000000A640000-0x000000000A68B000-memory.dmp

Filesize
300KB

Download
memory/4852-189-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-197-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-199-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-201-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-203-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-205-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-207-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-209-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-211-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-213-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-215-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-217-0x0000000001E90000-0x0000000001EDB000-memory.dmp

Filesize
300KB

Download
memory/4852-218-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-222-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-220-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4852-224-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4852-221-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4852-1096-0x00000000055E0000-0x0000000005BE6000-memory.dmp

Filesize
6.0MB

Download
memory/4852-1097-0x0000000005050000-0x000000000515A000-memory.dmp

Filesize
1.0MB

Download
memory/4852-1098-0x0000000005190000-0x00000000051A2000-memory.dmp

Filesize
72KB

Download
memory/4852-1099-0x00000000051B0000-0x00000000051EE000-memory.dmp

Filesize
248KB

Download
memory/4852-1100-0x0000000005300000-0x000000000534B000-memory.dmp

Filesize
300KB

Download
memory/4852-1101-0x0000000005490000-0x0000000005522000-memory.dmp

Filesize
584KB

Download
memory/4852-1102-0x0000000005530000-0x0000000005596000-memory.dmp

Filesize
408KB

Download
memory/4852-1104-0x0000000006330000-0x00000000063A6000-memory.dmp

Filesize
472KB

Download
memory/4852-1105-0x00000000063B0000-0x0000000006400000-memory.dmp

Filesize
320KB

Download
memory/4852-1106-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4852-1107-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4852-1108-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/4852-195-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-193-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-191-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-187-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-186-0x0000000004F60000-0x0000000004F9F000-memory.dmp

Filesize
252KB

Download
memory/4852-185-0x0000000004F60000-0x0000000004FA4000-memory.dmp

Filesize
272KB

Download
memory/4852-184-0x0000000002280000-0x00000000022C6000-memory.dmp

Filesize
280KB

Download
memory/4852-1109-0x0000000006440000-0x0000000006602000-memory.dmp

Filesize
1.8MB

Download
memory/4852-1110-0x0000000006610000-0x0000000006B3C000-memory.dmp

Filesize
5.2MB

Download
memory/4852-1111-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download