amadey | 69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a

Analysis

max time kernel
146s
max time network
146s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
11/04/2023, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe
Size

927KB
MD5

25195ac3dbd25a23e2c0b8cdbd885ec5
SHA1

db464ef131c0d0d234b16941afb014707b4e5cd2
SHA256

69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a
SHA512

eaddc0b9a7441cdd82d56456e62b654fce0e84b3e1110cc70bbd3d0a4ba6655da1e75e615445d9fb35119563bd802c25281cbcc0d674d959f03094daf5a3c1cf
SSDEEP

12288:SMrLy90zlr0YcjhBAfyykh66ntl+C4gMrC3eg+QDw5y6w4Gz/sQdYebZQ5:FyWlr0Y+AfI7tAC49K+n4vLxbZQ5

Score

10^/10

amadey redline nahui rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

176.113.115.145:4125

Attributes

auth_value
b9ed10946d21e28d58d0c72c535cde6f

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr907722.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr907722.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr907722.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr907722.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr907722.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 22 IoCs

resource	yara_rule
behavioral1/memory/2804-188-0x00000000024D0000-0x0000000002516000-memory.dmp	family_redline
behavioral1/memory/2804-189-0x0000000004A50000-0x0000000004A94000-memory.dmp	family_redline
behavioral1/memory/2804-190-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-191-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-193-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-195-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-197-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-199-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-201-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-203-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-205-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-207-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-209-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-211-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-215-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-213-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-217-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-219-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-221-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-223-0x0000000004A50000-0x0000000004A8F000-memory.dmp	family_redline
behavioral1/memory/2804-1108-0x0000000004B50000-0x0000000004B60000-memory.dmp	family_redline
behavioral1/memory/2804-1109-0x0000000004B50000-0x0000000004B60000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
3280	un255408.exe
3396	un247825.exe
3408	pr907722.exe
2804	qu837706.exe
4812	rk984317.exe
4816	si995403.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr907722.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr907722.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un255408.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un247825.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un247825.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un255408.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4408	4816	WerFault.exe	72
4072	4816	WerFault.exe	72
4444	4816	WerFault.exe	72
4480	4816	WerFault.exe	72
4448	4816	WerFault.exe	72
5072	4816	WerFault.exe	72
4992	4816	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3408	pr907722.exe
3408	pr907722.exe
2804	qu837706.exe
2804	qu837706.exe
4812	rk984317.exe
4812	rk984317.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3408	pr907722.exe
Token: SeDebugPrivilege	2804	qu837706.exe
Token: SeDebugPrivilege	4812	rk984317.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3280	2900	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe	66
PID 2900 wrote to memory of 3280	2900	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe	66
PID 2900 wrote to memory of 3280	2900	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe	66
PID 3280 wrote to memory of 3396	3280	un255408.exe	67
PID 3280 wrote to memory of 3396	3280	un255408.exe	67
PID 3280 wrote to memory of 3396	3280	un255408.exe	67
PID 3396 wrote to memory of 3408	3396	un247825.exe	68
PID 3396 wrote to memory of 3408	3396	un247825.exe	68
PID 3396 wrote to memory of 3408	3396	un247825.exe	68
PID 3396 wrote to memory of 2804	3396	un247825.exe	69
PID 3396 wrote to memory of 2804	3396	un247825.exe	69
PID 3396 wrote to memory of 2804	3396	un247825.exe	69
PID 3280 wrote to memory of 4812	3280	un255408.exe	71
PID 3280 wrote to memory of 4812	3280	un255408.exe	71
PID 3280 wrote to memory of 4812	3280	un255408.exe	71
PID 2900 wrote to memory of 4816	2900	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe	72
PID 2900 wrote to memory of 4816	2900	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe	72
PID 2900 wrote to memory of 4816	2900	69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe	72

C:\Users\Admin\AppData\Local\Temp\69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe
"C:\Users\Admin\AppData\Local\Temp\69a2007dfed72416f31dd04a1d9c0f1a5e2eee22161450344675ec8a2b57390a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255408.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255408.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un247825.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un247825.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr907722.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr907722.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu837706.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu837706.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk984317.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk984317.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995403.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995403.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 620
    3⤵
    - Program crash
    PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 696
    3⤵
    - Program crash
    PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 768
    3⤵
    - Program crash
    PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 844
    3⤵
    - Program crash
    PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 880
    3⤵
    - Program crash
    PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 920
    3⤵
    - Program crash
    PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1072
    3⤵
    - Program crash
    PID:4992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995403.exe

Filesize
231KB

MD5
8f72e39dc917ec2036dc9f331f9a536f

SHA1
e1c13d690c796c8824777adacaf2be4204ce0f97

SHA256
173a4511cff68489f4aa2e141441f87ac3692ebb24f9771b46d6034b5970a3e3

SHA512
b38fa982bf6427ab6b844896e87e652209ab7d9adf1311bfd740b5b4f428185837cc6d520ec5ac687e5b07bf4fd88ed1105a51a8dcdf450c10a34c09dc3ecc29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995403.exe

Filesize
231KB

MD5
8f72e39dc917ec2036dc9f331f9a536f

SHA1
e1c13d690c796c8824777adacaf2be4204ce0f97

SHA256
173a4511cff68489f4aa2e141441f87ac3692ebb24f9771b46d6034b5970a3e3

SHA512
b38fa982bf6427ab6b844896e87e652209ab7d9adf1311bfd740b5b4f428185837cc6d520ec5ac687e5b07bf4fd88ed1105a51a8dcdf450c10a34c09dc3ecc29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255408.exe

Filesize
663KB

MD5
73f1992cdd15760339a19fe14fa0a8d9

SHA1
cbb868ca6fd64a8ba99edc233372dbdb6f6444f5

SHA256
b47781d35a225607a402f42d36150b0d8b01e4bd6296cc32d78f626f99c4aeb4

SHA512
b6d0ad1ce98f6d62214eb9759a04cadaa2e16840587c5ff426f015d5ed3816360b9f98dc7dec8ef84eea9090765aeaa39ce44b5a4f529836090a2871e1756063

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un255408.exe

Filesize
663KB

MD5
73f1992cdd15760339a19fe14fa0a8d9

SHA1
cbb868ca6fd64a8ba99edc233372dbdb6f6444f5

SHA256
b47781d35a225607a402f42d36150b0d8b01e4bd6296cc32d78f626f99c4aeb4

SHA512
b6d0ad1ce98f6d62214eb9759a04cadaa2e16840587c5ff426f015d5ed3816360b9f98dc7dec8ef84eea9090765aeaa39ce44b5a4f529836090a2871e1756063

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk984317.exe

Filesize
175KB

MD5
b2e599dec0856d70ebb2ab2327ae6442

SHA1
300323436b47ddafa78cb7e835deb1ab09f13698

SHA256
b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

SHA512
c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk984317.exe

Filesize
175KB

MD5
b2e599dec0856d70ebb2ab2327ae6442

SHA1
300323436b47ddafa78cb7e835deb1ab09f13698

SHA256
b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

SHA512
c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un247825.exe

Filesize
521KB

MD5
f66ffdac53ef5ee295e1ea2e02e67826

SHA1
9bc6b9a7e8dbce1d3e39cf7d560f4aac29d23f7b

SHA256
910a3b37fe1c1e4da073e48f9d178f71bcd527579e01c8e1195889492bb568cd

SHA512
28d263a08ce16d3b216ca26f03af9913db6fd2bad4f2db301a83285276412aef2a18faefcded08b076776ef7d76a021025ecd84550fde73cad33fda53cb98b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un247825.exe

Filesize
521KB

MD5
f66ffdac53ef5ee295e1ea2e02e67826

SHA1
9bc6b9a7e8dbce1d3e39cf7d560f4aac29d23f7b

SHA256
910a3b37fe1c1e4da073e48f9d178f71bcd527579e01c8e1195889492bb568cd

SHA512
28d263a08ce16d3b216ca26f03af9913db6fd2bad4f2db301a83285276412aef2a18faefcded08b076776ef7d76a021025ecd84550fde73cad33fda53cb98b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr907722.exe

Filesize
240KB

MD5
460e0f9a449a0806bbfe14d82dff5eb8

SHA1
42886adeae1eb9b9563f87c1e9819c25444c85be

SHA256
913f717ac3d84a8cb6847499a22494cf7b0baa3b377c26ee1ea6e0a7e3dd267d

SHA512
efa4fd7cc6b4754383c40bc59877fb24bc51ed491a654de90e422a57d32ff712a49c18041a63a7024ed1d1ba5e7e751f54c89520e22b002d7820a9588fc4503e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr907722.exe

Filesize
240KB

MD5
460e0f9a449a0806bbfe14d82dff5eb8

SHA1
42886adeae1eb9b9563f87c1e9819c25444c85be

SHA256
913f717ac3d84a8cb6847499a22494cf7b0baa3b377c26ee1ea6e0a7e3dd267d

SHA512
efa4fd7cc6b4754383c40bc59877fb24bc51ed491a654de90e422a57d32ff712a49c18041a63a7024ed1d1ba5e7e751f54c89520e22b002d7820a9588fc4503e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu837706.exe

Filesize
299KB

MD5
aabbc28cb5daeca3547382506be8ffb5

SHA1
26e101c2c3e380e7b87db87bcce3e3d03ceba447

SHA256
0d4604ce3774c9c11211aed5a809a655a48ddcdb6493febe95b26916346e05b5

SHA512
999dbb39438539bba15f53801c9119694d7ba2854b41a5ee690a96817c737367a40ff4c6c85ad223d9bbaaa161ed9f9b4cf400833ef66132f8642fc5a410128f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu837706.exe

Filesize
299KB

MD5
aabbc28cb5daeca3547382506be8ffb5

SHA1
26e101c2c3e380e7b87db87bcce3e3d03ceba447

SHA256
0d4604ce3774c9c11211aed5a809a655a48ddcdb6493febe95b26916346e05b5

SHA512
999dbb39438539bba15f53801c9119694d7ba2854b41a5ee690a96817c737367a40ff4c6c85ad223d9bbaaa161ed9f9b4cf400833ef66132f8642fc5a410128f

Download Submit
memory/2804-1101-0x0000000005670000-0x000000000577A000-memory.dmp

Filesize
1.0MB

Download
memory/2804-1105-0x0000000005910000-0x000000000595B000-memory.dmp

Filesize
300KB

Download
memory/2804-1116-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-1115-0x0000000006500000-0x0000000006A2C000-memory.dmp

Filesize
5.2MB

Download
memory/2804-1114-0x0000000006320000-0x00000000064E2000-memory.dmp

Filesize
1.8MB

Download
memory/2804-1113-0x00000000062B0000-0x0000000006300000-memory.dmp

Filesize
320KB

Download
memory/2804-1112-0x0000000006210000-0x0000000006286000-memory.dmp

Filesize
472KB

Download
memory/2804-1111-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Filesize
408KB

Download
memory/2804-1110-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-1109-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-1108-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-1107-0x0000000005AA0000-0x0000000005B32000-memory.dmp

Filesize
584KB

Download
memory/2804-1104-0x00000000057C0000-0x00000000057FE000-memory.dmp

Filesize
248KB

Download
memory/2804-1103-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-1102-0x00000000057A0000-0x00000000057B2000-memory.dmp

Filesize
72KB

Download
memory/2804-1100-0x0000000005060000-0x0000000005666000-memory.dmp

Filesize
6.0MB

Download
memory/2804-283-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-281-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-279-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2804-277-0x00000000005E0000-0x000000000062B000-memory.dmp

Filesize
300KB

Download
memory/2804-223-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-221-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-219-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-188-0x00000000024D0000-0x0000000002516000-memory.dmp

Filesize
280KB

Download
memory/2804-189-0x0000000004A50000-0x0000000004A94000-memory.dmp

Filesize
272KB

Download
memory/2804-190-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-191-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-193-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-195-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-197-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-199-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-201-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-203-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-205-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-207-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-209-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-211-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-215-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-213-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/2804-217-0x0000000004A50000-0x0000000004A8F000-memory.dmp

Filesize
252KB

Download
memory/3408-167-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-163-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-183-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3408-181-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/3408-180-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/3408-179-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/3408-178-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3408-177-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-148-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/3408-175-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-173-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-171-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-150-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-169-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-147-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/3408-149-0x00000000021D0000-0x00000000021E8000-memory.dmp

Filesize
96KB

Download
memory/3408-159-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-161-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-165-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-157-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-155-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-153-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-151-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/3408-146-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/3408-145-0x0000000004B40000-0x000000000503E000-memory.dmp

Filesize
5.0MB

Download
memory/3408-143-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/3408-144-0x0000000002030000-0x000000000204A000-memory.dmp

Filesize
104KB

Download
memory/4812-1124-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/4812-1123-0x0000000004DD0000-0x0000000004E1B000-memory.dmp

Filesize
300KB

Download
memory/4812-1122-0x0000000000510000-0x0000000000542000-memory.dmp

Filesize
200KB

Download
memory/4816-1130-0x00000000005D0000-0x000000000060B000-memory.dmp

Filesize
236KB

Download