amadey | 7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6 | Triage

Analysis

max time kernel
147s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
12/04/2023, 05:40 UTC

Sharing

Report Analysis Logs

General

Target

7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe
Size

1.1MB
MD5

8e946b3d99fc337665a84cb8a84e11c8
SHA1

448e47df2ca7e2336f92eb4694823d3405f40168
SHA256

7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6
SHA512

a1110f8e306d1363ce4e7e1465604852b3869f55f1ae6795acbb5e50ebd82a41087936e83ec2d479bf2cb3b161e539b916e4902134e6eeabb551d59544fa6542
SSDEEP

24576:Vy6CtSpdNZRekzkCMpiRCQJyphbT4BqBuEJ39WhD+Sg3jeewjjqL:w6CtS7zFkti0IybT4BkumkDREjeTjj

Score

10^/10

amadey redline diza lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diza

C2

185.161.248.90:4125

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

Modify Registry

Modify Existing Service

Disabling Security Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr245143.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr245143.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr245143.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr245143.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr245143.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

pid	Process
3620	un516269.exe
3588	un820405.exe
3736	pr245143.exe
4964	qu435244.exe
2996	1.exe
3592	rk349286.exe
1532	si422003.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr245143.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr245143.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un820405.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un820405.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un516269.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un516269.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4220	1532	WerFault.exe	73
3080	1532	WerFault.exe	73
4204	1532	WerFault.exe	73
3492	1532	WerFault.exe	73
3732	1532	WerFault.exe	73
4864	1532	WerFault.exe	73
2820	1532	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3736	pr245143.exe
3736	pr245143.exe
2996	1.exe
3592	rk349286.exe
2996	1.exe
3592	rk349286.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	pr245143.exe
Token: SeDebugPrivilege	4964	qu435244.exe
Token: SeDebugPrivilege	2996	1.exe
Token: SeDebugPrivilege	3592	rk349286.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3620	3452	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe	66
PID 3452 wrote to memory of 3620	3452	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe	66
PID 3452 wrote to memory of 3620	3452	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe	66
PID 3620 wrote to memory of 3588	3620	un516269.exe	67
PID 3620 wrote to memory of 3588	3620	un516269.exe	67
PID 3620 wrote to memory of 3588	3620	un516269.exe	67
PID 3588 wrote to memory of 3736	3588	un820405.exe	68
PID 3588 wrote to memory of 3736	3588	un820405.exe	68
PID 3588 wrote to memory of 3736	3588	un820405.exe	68
PID 3588 wrote to memory of 4964	3588	un820405.exe	69
PID 3588 wrote to memory of 4964	3588	un820405.exe	69
PID 3588 wrote to memory of 4964	3588	un820405.exe	69
PID 4964 wrote to memory of 2996	4964	qu435244.exe	70
PID 4964 wrote to memory of 2996	4964	qu435244.exe	70
PID 4964 wrote to memory of 2996	4964	qu435244.exe	70
PID 3620 wrote to memory of 3592	3620	un516269.exe	71
PID 3620 wrote to memory of 3592	3620	un516269.exe	71
PID 3620 wrote to memory of 3592	3620	un516269.exe	71
PID 3452 wrote to memory of 1532	3452	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe	73
PID 3452 wrote to memory of 1532	3452	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe	73
PID 3452 wrote to memory of 1532	3452	7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe	73

C:\Users\Admin\AppData\Local\Temp\7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe
"C:\Users\Admin\AppData\Local\Temp\7950efb42a165ec5a21a7a3e9a9f73a7e4391c036f068abea3f441373e22c3b6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un516269.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un516269.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un820405.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un820405.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr245143.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr245143.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu435244.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu435244.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk349286.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk349286.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si422003.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si422003.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 632
    3⤵
    - Program crash
    PID:4220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 708
    3⤵
    - Program crash
    PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 844
    3⤵
    - Program crash
    PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 896
    3⤵
    - Program crash
    PID:3492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 944
    3⤵
    - Program crash
    PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 912
    3⤵
    - Program crash
    PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 1088
    3⤵
    - Program crash
    PID:2820

Network

DNS

90.248.161.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

90.248.161.185.in-addr.arpa

IN PTR

Response
DNS

52.4.107.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

52.4.107.13.in-addr.arpa

IN PTR

Response
DNS

1.77.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.77.109.52.in-addr.arpa

IN PTR

Response

185.161.248.90:4125

rk349286.exe

1.2MB
20.2kB
806
352
185.161.248.90:4125

1.exe

1.2MB
18.3kB
809
305
20.189.173.9:443

322 B
7
8.238.179.126:80

322 B
7

8.8.8.8:53

90.248.161.185.in-addr.arpa

dns

73 B
133 B
1
1

DNS Request

90.248.161.185.in-addr.arpa
8.8.8.8:53

52.4.107.13.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

52.4.107.13.in-addr.arpa
8.8.8.8:53

1.77.109.52.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

1.77.109.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si422003.exe

Filesize
394KB

MD5
a5409bb35b6d1e8bc803c4d5c39a59eb

SHA1
0bf9f6a45e23c26cc677cd79e97fd98fd792bc09

SHA256
a0a4d26879150e911db9e32b1fcecb749fee9dc811109ee84a09416290d5a60d

SHA512
f88fe58ca4187678c0e5364c10f8ffa3986ebeef49d32f954c0a9ee5f896da09386ea5e4d5657afaf9f65ec0471a579f9544650b7caa633af9c77cbb26bc3f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si422003.exe

Filesize
394KB

MD5
a5409bb35b6d1e8bc803c4d5c39a59eb

SHA1
0bf9f6a45e23c26cc677cd79e97fd98fd792bc09

SHA256
a0a4d26879150e911db9e32b1fcecb749fee9dc811109ee84a09416290d5a60d

SHA512
f88fe58ca4187678c0e5364c10f8ffa3986ebeef49d32f954c0a9ee5f896da09386ea5e4d5657afaf9f65ec0471a579f9544650b7caa633af9c77cbb26bc3f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un516269.exe

Filesize
850KB

MD5
dfc214c5ada9283a94b26be9975667a7

SHA1
a678e21b254d84bca05c0d4cd430bbf64270c9cc

SHA256
bad19ceb2447463f8012e7a52e19caf9ef24cafb494e86b152307ae23cd833ac

SHA512
2fc71e17350826bf31282610d6607b723fa3c154850e443862a0e4fc87e7945160617cd5e48e9d23fa752ed465e57d38773cdb597414bdc28e62a6b0dce6fb5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un516269.exe

Filesize
850KB

MD5
dfc214c5ada9283a94b26be9975667a7

SHA1
a678e21b254d84bca05c0d4cd430bbf64270c9cc

SHA256
bad19ceb2447463f8012e7a52e19caf9ef24cafb494e86b152307ae23cd833ac

SHA512
2fc71e17350826bf31282610d6607b723fa3c154850e443862a0e4fc87e7945160617cd5e48e9d23fa752ed465e57d38773cdb597414bdc28e62a6b0dce6fb5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk349286.exe

Filesize
168KB

MD5
c52ebada00a59ec1f651a0e9fbcef2eb

SHA1
e1941278df76616f1ca3202ef2a9f99d2592d52f

SHA256
35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

SHA512
6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk349286.exe

Filesize
168KB

MD5
c52ebada00a59ec1f651a0e9fbcef2eb

SHA1
e1941278df76616f1ca3202ef2a9f99d2592d52f

SHA256
35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

SHA512
6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un820405.exe

Filesize
697KB

MD5
6c124ccc29d489eb5c21e2ce3f76beab

SHA1
570cd391038bc35e0d7cc18b430e42ff8f6727c8

SHA256
6f7a951d90156e7c6b20bc0f837c58754238351e692fbbe60cc6502881e4434d

SHA512
d97d57782dd111598aaf3a834cacbbb97bdaae25b25de89c3631b20123874acb1c357c014d65a04327c97109b1e1c11733429a3ff19e7ac3ecc3ffeed457e24b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un820405.exe

Filesize
697KB

MD5
6c124ccc29d489eb5c21e2ce3f76beab

SHA1
570cd391038bc35e0d7cc18b430e42ff8f6727c8

SHA256
6f7a951d90156e7c6b20bc0f837c58754238351e692fbbe60cc6502881e4434d

SHA512
d97d57782dd111598aaf3a834cacbbb97bdaae25b25de89c3631b20123874acb1c357c014d65a04327c97109b1e1c11733429a3ff19e7ac3ecc3ffeed457e24b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr245143.exe

Filesize
403KB

MD5
91d6a86390d0e60af4375d1fc1d58525

SHA1
89d8243b1eba356fbc2a200c0f79f0f9a7c12b80

SHA256
166eba8fd278348bb64910e7d060c7c18cab199462c8330b3360121a9e4a0f8d

SHA512
5970c62f3d30c721450fb12bc041fe9ef7a453fd8f9bfb2f65adf40cd93d97effa02eef005d724eb7e68c10eb2ef462bd384141d148096f77caadce6653fd3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr245143.exe

Filesize
403KB

MD5
91d6a86390d0e60af4375d1fc1d58525

SHA1
89d8243b1eba356fbc2a200c0f79f0f9a7c12b80

SHA256
166eba8fd278348bb64910e7d060c7c18cab199462c8330b3360121a9e4a0f8d

SHA512
5970c62f3d30c721450fb12bc041fe9ef7a453fd8f9bfb2f65adf40cd93d97effa02eef005d724eb7e68c10eb2ef462bd384141d148096f77caadce6653fd3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu435244.exe

Filesize
586KB

MD5
7acab82ea85602a344e224c92d79d783

SHA1
d4de6dc417d07784a84dba5e9af9261e2bf20c90

SHA256
9bdf92f6c9b107f7668b7c445db66d27df42bd9fdff815e507c922c3d46bdcc8

SHA512
b596175fefbfc7013dd6066be12615694890410bf39ac5710a1f5e324926562b19d443820f936975bace8270a82eea0b24572ca9e438b8815c80c42cd11b4585

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu435244.exe

Filesize
586KB

MD5
7acab82ea85602a344e224c92d79d783

SHA1
d4de6dc417d07784a84dba5e9af9261e2bf20c90

SHA256
9bdf92f6c9b107f7668b7c445db66d27df42bd9fdff815e507c922c3d46bdcc8

SHA512
b596175fefbfc7013dd6066be12615694890410bf39ac5710a1f5e324926562b19d443820f936975bace8270a82eea0b24572ca9e438b8815c80c42cd11b4585

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
memory/1532-2368-0x0000000002360000-0x000000000239B000-memory.dmp

Filesize
236KB

Download
memory/2996-2354-0x0000000004F90000-0x0000000005006000-memory.dmp

Filesize
472KB

Download
memory/2996-2357-0x0000000005EA0000-0x0000000006062000-memory.dmp

Filesize
1.8MB

Download
memory/2996-2340-0x0000000000200000-0x000000000022E000-memory.dmp

Filesize
184KB

Download
memory/2996-2360-0x00000000060E0000-0x0000000006130000-memory.dmp

Filesize
320KB

Download
memory/2996-2351-0x0000000004B80000-0x0000000004BBE000-memory.dmp

Filesize
248KB

Download
memory/2996-2341-0x0000000002420000-0x0000000002426000-memory.dmp

Filesize
24KB

Download
memory/2996-2349-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/2996-2350-0x0000000004A00000-0x0000000004A12000-memory.dmp

Filesize
72KB

Download
memory/2996-2359-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/3592-2347-0x000000000A6A0000-0x000000000ACA6000-memory.dmp

Filesize
6.0MB

Download
memory/3592-2346-0x0000000004BC0000-0x0000000004BC6000-memory.dmp

Filesize
24KB

Download
memory/3592-2345-0x0000000000410000-0x0000000000440000-memory.dmp

Filesize
192KB

Download
memory/3592-2355-0x000000000A5E0000-0x000000000A672000-memory.dmp

Filesize
584KB

Download
memory/3592-2358-0x000000000C020000-0x000000000C54C000-memory.dmp

Filesize
5.2MB

Download
memory/3592-2348-0x000000000A210000-0x000000000A31A000-memory.dmp

Filesize
1.0MB

Download
memory/3592-2356-0x000000000A540000-0x000000000A5A6000-memory.dmp

Filesize
408KB

Download
memory/3592-2352-0x000000000A320000-0x000000000A36B000-memory.dmp

Filesize
300KB

Download
memory/3592-2353-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/3592-2361-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/3736-165-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-178-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/3736-143-0x0000000002740000-0x000000000275A000-memory.dmp

Filesize
104KB

Download
memory/3736-144-0x0000000002310000-0x000000000233D000-memory.dmp

Filesize
180KB

Download
memory/3736-145-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/3736-146-0x0000000004FD0000-0x00000000054CE000-memory.dmp

Filesize
5.0MB

Download
memory/3736-147-0x00000000028D0000-0x00000000028E8000-memory.dmp

Filesize
96KB

Download
memory/3736-148-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-149-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-151-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-153-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-155-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-157-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-159-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-161-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-163-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-167-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-169-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-171-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-173-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-175-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3736-176-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/4964-211-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-215-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-185-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/4964-184-0x00000000029F0000-0x0000000002A58000-memory.dmp

Filesize
416KB

Download
memory/4964-183-0x0000000002360000-0x00000000023BB000-memory.dmp

Filesize
364KB

Download
memory/4964-186-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-187-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-2331-0x0000000005630000-0x0000000005662000-memory.dmp

Filesize
200KB

Download
memory/4964-275-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/4964-271-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/4964-273-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/4964-219-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-217-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-2339-0x0000000002360000-0x00000000023BB000-memory.dmp

Filesize
364KB

Download
memory/4964-213-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-189-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-209-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-207-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-205-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-203-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-201-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-199-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-197-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-195-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-193-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download
memory/4964-191-0x0000000005430000-0x0000000005490000-memory.dmp

Filesize
384KB

Download