amadey | 5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e

Analysis

max time kernel
140s
max time network
139s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
11/04/2023, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe
Size

789KB
MD5

07cfdc249df5a4ced508137ad086971a
SHA1

16d9e6b2ba5f80d62a9366c48af539bde536a0ab
SHA256

5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e
SHA512

d45213447c145132e5b2c19c17e391c271807fb76784cb570a344b867fd5e89fff36d5f3d6cd780e1c9510d619827e29ece8678057fbab1492454850f8ea4e99
SSDEEP

12288:AMruy900s0WHd9jKKS+Sl9gylFkl57olPBT+dw5ZNfpZwZ76EZwX91NGfUmC/g:ey2jdSxFklKrTpffZw96EZwX7SUm8g

Score

10^/10

amadey redline nahui rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

176.113.115.145:4125

Attributes

auth_value
b9ed10946d21e28d58d0c72c535cde6f

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it041608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it041608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it041608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it041608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it041608.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 37 IoCs

resource	yara_rule
behavioral1/memory/4916-143-0x0000000002140000-0x0000000002186000-memory.dmp	family_redline
behavioral1/memory/4916-145-0x0000000000790000-0x00000000007A0000-memory.dmp	family_redline
behavioral1/memory/4916-147-0x0000000004F90000-0x0000000004FD4000-memory.dmp	family_redline
behavioral1/memory/4916-148-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-149-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-151-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-153-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-155-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-157-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-159-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-161-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-163-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-165-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-167-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-169-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-172-0x0000000000790000-0x00000000007A0000-memory.dmp	family_redline
behavioral1/memory/4916-173-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-175-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-177-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-179-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-181-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-183-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-185-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-187-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-189-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-191-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-193-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-195-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-197-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-199-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-201-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-203-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-205-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-207-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-209-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-211-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline
behavioral1/memory/4916-213-0x0000000004F90000-0x0000000004FCF000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
3548	zigB5264.exe
2348	ziDa5715.exe
4500	it041608.exe
4916	jr851823.exe
2204	kp193730.exe
2096	lr179467.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it041608.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zigB5264.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zigB5264.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziDa5715.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziDa5715.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4452	2096	WerFault.exe	72
3580	2096	WerFault.exe	72
4172	2096	WerFault.exe	72
3688	2096	WerFault.exe	72
1740	2096	WerFault.exe	72
2780	2096	WerFault.exe	72
3076	2096	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4500	it041608.exe
4500	it041608.exe
4916	jr851823.exe
4916	jr851823.exe
2204	kp193730.exe
2204	kp193730.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	it041608.exe
Token: SeDebugPrivilege	4916	jr851823.exe
Token: SeDebugPrivilege	2204	kp193730.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 3548	4124	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe	66
PID 4124 wrote to memory of 3548	4124	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe	66
PID 4124 wrote to memory of 3548	4124	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe	66
PID 3548 wrote to memory of 2348	3548	zigB5264.exe	67
PID 3548 wrote to memory of 2348	3548	zigB5264.exe	67
PID 3548 wrote to memory of 2348	3548	zigB5264.exe	67
PID 2348 wrote to memory of 4500	2348	ziDa5715.exe	68
PID 2348 wrote to memory of 4500	2348	ziDa5715.exe	68
PID 2348 wrote to memory of 4916	2348	ziDa5715.exe	69
PID 2348 wrote to memory of 4916	2348	ziDa5715.exe	69
PID 2348 wrote to memory of 4916	2348	ziDa5715.exe	69
PID 3548 wrote to memory of 2204	3548	zigB5264.exe	71
PID 3548 wrote to memory of 2204	3548	zigB5264.exe	71
PID 3548 wrote to memory of 2204	3548	zigB5264.exe	71
PID 4124 wrote to memory of 2096	4124	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe	72
PID 4124 wrote to memory of 2096	4124	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe	72
PID 4124 wrote to memory of 2096	4124	5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe	72

C:\Users\Admin\AppData\Local\Temp\5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe
"C:\Users\Admin\AppData\Local\Temp\5af602804ab9854a2e029ab2551c28014c5518222c6b89b4714201b6d16f6f7e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigB5264.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigB5264.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDa5715.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDa5715.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041608.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041608.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr851823.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr851823.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4916
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp193730.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp193730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179467.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179467.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 616
    3⤵
    - Program crash
    PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 696
    3⤵
    - Program crash
    PID:3580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 836
    3⤵
    - Program crash
    PID:4172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 844
    3⤵
    - Program crash
    PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 872
    3⤵
    - Program crash
    PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 884
    3⤵
    - Program crash
    PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1068
    3⤵
    - Program crash
    PID:3076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179467.exe

Filesize
231KB

MD5
8f72e39dc917ec2036dc9f331f9a536f

SHA1
e1c13d690c796c8824777adacaf2be4204ce0f97

SHA256
173a4511cff68489f4aa2e141441f87ac3692ebb24f9771b46d6034b5970a3e3

SHA512
b38fa982bf6427ab6b844896e87e652209ab7d9adf1311bfd740b5b4f428185837cc6d520ec5ac687e5b07bf4fd88ed1105a51a8dcdf450c10a34c09dc3ecc29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr179467.exe

Filesize
231KB

MD5
8f72e39dc917ec2036dc9f331f9a536f

SHA1
e1c13d690c796c8824777adacaf2be4204ce0f97

SHA256
173a4511cff68489f4aa2e141441f87ac3692ebb24f9771b46d6034b5970a3e3

SHA512
b38fa982bf6427ab6b844896e87e652209ab7d9adf1311bfd740b5b4f428185837cc6d520ec5ac687e5b07bf4fd88ed1105a51a8dcdf450c10a34c09dc3ecc29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigB5264.exe

Filesize
524KB

MD5
f1a9eb9f7e0ab5d89c89b14421c0a442

SHA1
d72af21e6aebc10ce57f10a76aca0e842e85e739

SHA256
a73decde331a4db0a3e8b856e8a8bb4b9f706f43950aceec7ae722e5dd045adf

SHA512
4974e93cbed099ca350697294d3ce423b81f2e7675b371ee7cc5fdc8e802de8dace6241d29d33d6ce16a2e86518ecd1e66225ddc595b2c0633a199598c6b358c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigB5264.exe

Filesize
524KB

MD5
f1a9eb9f7e0ab5d89c89b14421c0a442

SHA1
d72af21e6aebc10ce57f10a76aca0e842e85e739

SHA256
a73decde331a4db0a3e8b856e8a8bb4b9f706f43950aceec7ae722e5dd045adf

SHA512
4974e93cbed099ca350697294d3ce423b81f2e7675b371ee7cc5fdc8e802de8dace6241d29d33d6ce16a2e86518ecd1e66225ddc595b2c0633a199598c6b358c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp193730.exe

Filesize
175KB

MD5
b2e599dec0856d70ebb2ab2327ae6442

SHA1
300323436b47ddafa78cb7e835deb1ab09f13698

SHA256
b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

SHA512
c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp193730.exe

Filesize
175KB

MD5
b2e599dec0856d70ebb2ab2327ae6442

SHA1
300323436b47ddafa78cb7e835deb1ab09f13698

SHA256
b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

SHA512
c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDa5715.exe

Filesize
382KB

MD5
7edafe0162753938ad747d778d6684b6

SHA1
7ba4a82f7f02d6923b1038be3080da3ec6a5c9e6

SHA256
bc679c6a5e534da70f477610c0bac36258fb4754e40e7adb97313b785fa454ef

SHA512
8ff37de562e8e7b6cef4affbd7644daf43278fbc62640d36c90871ab45e518c85b2f8932364ed7c9572bafea1f54bba84e690fc473747def106531c79af0ac60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDa5715.exe

Filesize
382KB

MD5
7edafe0162753938ad747d778d6684b6

SHA1
7ba4a82f7f02d6923b1038be3080da3ec6a5c9e6

SHA256
bc679c6a5e534da70f477610c0bac36258fb4754e40e7adb97313b785fa454ef

SHA512
8ff37de562e8e7b6cef4affbd7644daf43278fbc62640d36c90871ab45e518c85b2f8932364ed7c9572bafea1f54bba84e690fc473747def106531c79af0ac60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041608.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041608.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr851823.exe

Filesize
299KB

MD5
f9dded213b9e04efd1e73a415d99663c

SHA1
cb10a88473d3b8c696bb6d8a536622bb251d1a92

SHA256
8b7de51f435a647b41debf4b88987a5b9172212294b8ad687d0faa76f3c3f0fe

SHA512
8b7e3126c6283483a7cfbb3d875c7081aea0d894fe5e884157822b1415d384b04d4f4a55cc41618d697cfa7a59adc45df50a98d34181268070be44e418789a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr851823.exe

Filesize
299KB

MD5
f9dded213b9e04efd1e73a415d99663c

SHA1
cb10a88473d3b8c696bb6d8a536622bb251d1a92

SHA256
8b7de51f435a647b41debf4b88987a5b9172212294b8ad687d0faa76f3c3f0fe

SHA512
8b7e3126c6283483a7cfbb3d875c7081aea0d894fe5e884157822b1415d384b04d4f4a55cc41618d697cfa7a59adc45df50a98d34181268070be44e418789a67

Download Submit
memory/2096-1087-0x0000000000580000-0x00000000005BB000-memory.dmp

Filesize
236KB

Download
memory/2204-1079-0x00000000051A0000-0x00000000051EB000-memory.dmp

Filesize
300KB

Download
memory/2204-1078-0x0000000000730000-0x0000000000762000-memory.dmp

Filesize
200KB

Download
memory/2204-1081-0x0000000005070000-0x0000000005080000-memory.dmp

Filesize
64KB

Download
memory/2204-1080-0x0000000005070000-0x0000000005080000-memory.dmp

Filesize
64KB

Download
memory/4500-137-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/4916-181-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-199-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-151-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-153-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-155-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-157-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-159-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-161-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-163-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-165-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-167-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-169-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-172-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-173-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-170-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-175-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-177-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-179-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-148-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-183-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-185-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-187-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-189-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-191-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-193-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-195-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-197-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-149-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-201-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-203-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-205-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-207-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-209-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-211-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-213-0x0000000004F90000-0x0000000004FCF000-memory.dmp

Filesize
252KB

Download
memory/4916-1056-0x0000000005110000-0x0000000005716000-memory.dmp

Filesize
6.0MB

Download
memory/4916-1057-0x00000000057A0000-0x00000000058AA000-memory.dmp

Filesize
1.0MB

Download
memory/4916-1058-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/4916-1059-0x0000000005900000-0x000000000593E000-memory.dmp

Filesize
248KB

Download
memory/4916-1060-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-1061-0x0000000005A50000-0x0000000005A9B000-memory.dmp

Filesize
300KB

Download
memory/4916-1063-0x0000000005BE0000-0x0000000005C46000-memory.dmp

Filesize
408KB

Download
memory/4916-1064-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-1065-0x00000000062A0000-0x0000000006332000-memory.dmp

Filesize
584KB

Download
memory/4916-1066-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-1067-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-1068-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-147-0x0000000004F90000-0x0000000004FD4000-memory.dmp

Filesize
272KB

Download
memory/4916-146-0x0000000004A90000-0x0000000004F8E000-memory.dmp

Filesize
5.0MB

Download
memory/4916-145-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4916-144-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/4916-143-0x0000000002140000-0x0000000002186000-memory.dmp

Filesize
280KB

Download
memory/4916-1069-0x00000000065C0000-0x0000000006636000-memory.dmp

Filesize
472KB

Download
memory/4916-1070-0x0000000006650000-0x00000000066A0000-memory.dmp

Filesize
320KB

Download
memory/4916-1071-0x00000000066C0000-0x0000000006882000-memory.dmp

Filesize
1.8MB

Download
memory/4916-1072-0x0000000006890000-0x0000000006DBC000-memory.dmp

Filesize
5.2MB

Download