amadey | f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441

Analysis

max time kernel
143s
max time network
111s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
14-04-2023 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe
Size

1.0MB
MD5

6d0edc30b7c25a93ccabfda8186e68b4
SHA1

12f02d4b2ba1794564d2343b64c27fd9ec7f71a2
SHA256

f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441
SHA512

8ac5d6876add97f2b26b7ef5bca75a5b787df5cbb3786ce881088a1876a911a5c7053e7d3968f587e313c17a4f31be8dfc326a2dc945ed866e7f1f62a35f072c
SSDEEP

24576:CyoUOWgh6k0MJgi20MWNMjV9M0LwrYFL7U6RWS0bmmP6xGQM6:po1Wvk0+novw0FLQgWS0uxS

Score

10^/10

amadey redline disa lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

185.161.248.90:4125

Attributes

auth_value
93f8c4ca7000e3381dd4b6b86434de05

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

it569078.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it569078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it569078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it569078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it569078.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it569078.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 7 IoCs

Processes:

ziTP9407.exeziDP4824.exeit569078.exejr606844.exe1.exekp097807.exelr149899.exe

pid process

5084 ziTP9407.exe
3840 ziDP4824.exe
5100 it569078.exe
4220 jr606844.exe
5068 1.exe
1200 kp097807.exe
1056 lr149899.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

it569078.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it569078.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
5084	ziTP9407.exe
3840	ziDP4824.exe
5100	it569078.exe
4220	jr606844.exe
5068	1.exe
1200	kp097807.exe
1056	lr149899.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it569078.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ziDP4824.exef763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exeziTP9407.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziDP4824.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziTP9407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziTP9407.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziDP4824.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3788	1056	WerFault.exe	lr149899.exe
2896	1056	WerFault.exe	lr149899.exe
5008	1056	WerFault.exe	lr149899.exe
3808	1056	WerFault.exe	lr149899.exe
3820	1056	WerFault.exe	lr149899.exe
4436	1056	WerFault.exe	lr149899.exe
5100	1056	WerFault.exe	lr149899.exe
2068	1056	WerFault.exe	lr149899.exe
2092	1056	WerFault.exe	lr149899.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

it569078.exekp097807.exe1.exe

pid process

5100 it569078.exe
5100 it569078.exe
1200 kp097807.exe
1200 kp097807.exe
5068 1.exe
5068 1.exe

pid	process
5100	it569078.exe
5100	it569078.exe
1200	kp097807.exe
1200	kp097807.exe
5068	1.exe
5068	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

it569078.exejr606844.exekp097807.exe1.exe

description	pid	process
Token: SeDebugPrivilege	5100	it569078.exe
Token: SeDebugPrivilege	4220	jr606844.exe
Token: SeDebugPrivilege	1200	kp097807.exe
Token: SeDebugPrivilege	5068	1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

lr149899.exe

pid process

1056 lr149899.exe

pid	process
1056	lr149899.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exeziTP9407.exeziDP4824.exejr606844.exe

description	pid	process	target process
PID 4128 wrote to memory of 5084	4128	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe	ziTP9407.exe
PID 4128 wrote to memory of 5084	4128	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe	ziTP9407.exe
PID 4128 wrote to memory of 5084	4128	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe	ziTP9407.exe
PID 5084 wrote to memory of 3840	5084	ziTP9407.exe	ziDP4824.exe
PID 5084 wrote to memory of 3840	5084	ziTP9407.exe	ziDP4824.exe
PID 5084 wrote to memory of 3840	5084	ziTP9407.exe	ziDP4824.exe
PID 3840 wrote to memory of 5100	3840	ziDP4824.exe	it569078.exe
PID 3840 wrote to memory of 5100	3840	ziDP4824.exe	it569078.exe
PID 3840 wrote to memory of 4220	3840	ziDP4824.exe	jr606844.exe
PID 3840 wrote to memory of 4220	3840	ziDP4824.exe	jr606844.exe
PID 3840 wrote to memory of 4220	3840	ziDP4824.exe	jr606844.exe
PID 4220 wrote to memory of 5068	4220	jr606844.exe	1.exe
PID 4220 wrote to memory of 5068	4220	jr606844.exe	1.exe
PID 4220 wrote to memory of 5068	4220	jr606844.exe	1.exe
PID 5084 wrote to memory of 1200	5084	ziTP9407.exe	kp097807.exe
PID 5084 wrote to memory of 1200	5084	ziTP9407.exe	kp097807.exe
PID 5084 wrote to memory of 1200	5084	ziTP9407.exe	kp097807.exe
PID 4128 wrote to memory of 1056	4128	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe	lr149899.exe
PID 4128 wrote to memory of 1056	4128	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe	lr149899.exe
PID 4128 wrote to memory of 1056	4128	f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe	lr149899.exe

C:\Users\Admin\AppData\Local\Temp\f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe
"C:\Users\Admin\AppData\Local\Temp\f763c67e7f6d77375cb64235375cef496ffe8234c8fe6e0a526d20d80591b441.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTP9407.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTP9407.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDP4824.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDP4824.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it569078.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it569078.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr606844.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr606844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5068
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp097807.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp097807.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr149899.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr149899.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 632
    3⤵
    - Program crash
    PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 708
    3⤵
    - Program crash
    PID:2896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 844
    3⤵
    - Program crash
    PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 856
    3⤵
    - Program crash
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 884
    3⤵
    - Program crash
    PID:3820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 900
    3⤵
    - Program crash
    PID:4436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1124
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1164
    3⤵
    - Program crash
    PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1084
    3⤵
    - Program crash
    PID:2092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr149899.exe

Filesize
396KB

MD5
2d5adc88b61f67dd4a3d0af63556a9b2

SHA1
be2a227a96abc93b9ae975d80e298b30f7397ff9

SHA256
1e48b404d2d2964a05cf261b6a76f91b598c699a5ab7964e182a287b812aa318

SHA512
e5d941a3ccc88562eb9e27795ad337a2aa8f52547a5f4d81f0e6a6be7d121ef1e1179246135ac869554f07605682c76024ca1bdf84910e1b593a445dd8f3986a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr149899.exe

Filesize
396KB

MD5
2d5adc88b61f67dd4a3d0af63556a9b2

SHA1
be2a227a96abc93b9ae975d80e298b30f7397ff9

SHA256
1e48b404d2d2964a05cf261b6a76f91b598c699a5ab7964e182a287b812aa318

SHA512
e5d941a3ccc88562eb9e27795ad337a2aa8f52547a5f4d81f0e6a6be7d121ef1e1179246135ac869554f07605682c76024ca1bdf84910e1b593a445dd8f3986a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTP9407.exe

Filesize
724KB

MD5
0feede6eea56e844b68cafaac5e7b367

SHA1
2aabffb896f4b9db951655b5a50ee6a5a9df4f4d

SHA256
26baf4aff778c145725011d2e8bd4eb3b71a6167b9c649ab4664b4b5c3efc174

SHA512
9ac13f477d77255b28bc473ad5b6615e58a78087cd0ad8a13f5363aca667a250bf096df559f0a0eb19cb6be9bb24fd009c0b36ac3a6bac375926076ed0657676

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTP9407.exe

Filesize
724KB

MD5
0feede6eea56e844b68cafaac5e7b367

SHA1
2aabffb896f4b9db951655b5a50ee6a5a9df4f4d

SHA256
26baf4aff778c145725011d2e8bd4eb3b71a6167b9c649ab4664b4b5c3efc174

SHA512
9ac13f477d77255b28bc473ad5b6615e58a78087cd0ad8a13f5363aca667a250bf096df559f0a0eb19cb6be9bb24fd009c0b36ac3a6bac375926076ed0657676

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp097807.exe

Filesize
169KB

MD5
542f687a983e8c72ade008c4051ce31a

SHA1
4d6b8bb3da634bb7cc45fc0450b7570dc1ca15cd

SHA256
1589d246169b1b64f068cf3f4009e492334d414457b4f3df1edf63383e1fdfd5

SHA512
1f2010232efd02338edb6b0690b62fa655e315f0e9590fd6ea7e4f1e69d365f39992c45fe17c7085e15e329fe2ab4e65bfe0ffcd2c69eab241a7be07f0cce2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp097807.exe

Filesize
169KB

MD5
542f687a983e8c72ade008c4051ce31a

SHA1
4d6b8bb3da634bb7cc45fc0450b7570dc1ca15cd

SHA256
1589d246169b1b64f068cf3f4009e492334d414457b4f3df1edf63383e1fdfd5

SHA512
1f2010232efd02338edb6b0690b62fa655e315f0e9590fd6ea7e4f1e69d365f39992c45fe17c7085e15e329fe2ab4e65bfe0ffcd2c69eab241a7be07f0cce2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDP4824.exe

Filesize
570KB

MD5
7ef7b74b78760253f7a50acd3e953405

SHA1
62219ea8d2b8b6229fa6ec33088727ea9236898d

SHA256
e60614f2333680ece472e174f0475ee9eb1f78323c024df3b6b10c7423fb422d

SHA512
2c2000a2b20d20cb211c48f7731a311c399605e4d55b69fae006323314162e28462f716f9239fe8013d95e21dde1fedf82e026518fa003fd78f216a13dd8f0e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDP4824.exe

Filesize
570KB

MD5
7ef7b74b78760253f7a50acd3e953405

SHA1
62219ea8d2b8b6229fa6ec33088727ea9236898d

SHA256
e60614f2333680ece472e174f0475ee9eb1f78323c024df3b6b10c7423fb422d

SHA512
2c2000a2b20d20cb211c48f7731a311c399605e4d55b69fae006323314162e28462f716f9239fe8013d95e21dde1fedf82e026518fa003fd78f216a13dd8f0e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it569078.exe

Filesize
11KB

MD5
7f293390ece97501d4e27ffbc0ba2007

SHA1
349bf26671e817cde8f85895111ad91ebbcc61d1

SHA256
eda4a0aeca9b099b689364ff0d5d8e9dad34c16e78810163086cc27054ffd6f9

SHA512
244e5a41f39927b79ab3402eb7c127aed8a71e75669c6948325a4c4d2648fe2f34f87d807c9cd62b81dc8794210c4bc8b9666053df7b9f6a8a5cca579f513276

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it569078.exe

Filesize
11KB

MD5
7f293390ece97501d4e27ffbc0ba2007

SHA1
349bf26671e817cde8f85895111ad91ebbcc61d1

SHA256
eda4a0aeca9b099b689364ff0d5d8e9dad34c16e78810163086cc27054ffd6f9

SHA512
244e5a41f39927b79ab3402eb7c127aed8a71e75669c6948325a4c4d2648fe2f34f87d807c9cd62b81dc8794210c4bc8b9666053df7b9f6a8a5cca579f513276

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr606844.exe

Filesize
587KB

MD5
5bac61addba38d91a5275610ad501f2d

SHA1
d29b48cf23c4903dbafa23529460b7fe52947ef5

SHA256
38cee126b7eb516b02ef0c63b17508fd12c2fdaea8be6ee6472592e9b8003e6c

SHA512
9bc5d6d565157c3c3753d02e5502156d1746f23fd472763f298549753ff77c401f9eb15344a51b03f4c1fb8d34bb2d119254f0b3525d31a37cb678834a23ac76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr606844.exe

Filesize
587KB

MD5
5bac61addba38d91a5275610ad501f2d

SHA1
d29b48cf23c4903dbafa23529460b7fe52947ef5

SHA256
38cee126b7eb516b02ef0c63b17508fd12c2fdaea8be6ee6472592e9b8003e6c

SHA512
9bc5d6d565157c3c3753d02e5502156d1746f23fd472763f298549753ff77c401f9eb15344a51b03f4c1fb8d34bb2d119254f0b3525d31a37cb678834a23ac76

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
memory/1056-2339-0x00000000009A0000-0x00000000009DB000-memory.dmp

Filesize
236KB

Download
memory/1200-2329-0x000000000BE30000-0x000000000C35C000-memory.dmp

Filesize
5.2MB

Download
memory/1200-2323-0x000000000A140000-0x000000000A18B000-memory.dmp

Filesize
300KB

Download
memory/1200-2321-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/1200-2318-0x000000000A030000-0x000000000A13A000-memory.dmp

Filesize
1.0MB

Download
memory/1200-2316-0x0000000000980000-0x0000000000986000-memory.dmp

Filesize
24KB

Download
memory/1200-2325-0x000000000A2E0000-0x000000000A356000-memory.dmp

Filesize
472KB

Download
memory/1200-2315-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1200-2327-0x000000000A360000-0x000000000A3C6000-memory.dmp

Filesize
408KB

Download
memory/1200-2328-0x000000000B1B0000-0x000000000B372000-memory.dmp

Filesize
1.8MB

Download
memory/1200-2331-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4220-158-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4220-2303-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4220-176-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-178-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-180-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-182-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-184-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-186-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-188-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-190-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-192-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-194-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-196-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-198-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-200-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-202-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-204-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-206-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-210-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-208-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-212-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-214-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-216-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-218-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-2298-0x0000000005660000-0x0000000005692000-memory.dmp

Filesize
200KB

Download
memory/4220-2300-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4220-2301-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4220-174-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-2304-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4220-172-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-170-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-148-0x0000000000990000-0x00000000009EB000-memory.dmp

Filesize
364KB

Download
memory/4220-149-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4220-168-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-166-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-164-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-162-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-150-0x00000000027B0000-0x0000000002818000-memory.dmp

Filesize
416KB

Download
memory/4220-160-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4220-151-0x0000000004F90000-0x000000000548E000-memory.dmp

Filesize
5.0MB

Download
memory/4220-152-0x0000000005490000-0x00000000054F6000-memory.dmp

Filesize
408KB

Download
memory/4220-159-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-153-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-154-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/4220-156-0x0000000005490000-0x00000000054F0000-memory.dmp

Filesize
384KB

Download
memory/5068-2324-0x0000000005590000-0x00000000055DB000-memory.dmp

Filesize
300KB

Download
memory/5068-2326-0x0000000005960000-0x00000000059F2000-memory.dmp

Filesize
584KB

Download
memory/5068-2322-0x0000000005550000-0x000000000558E000-memory.dmp

Filesize
248KB

Download
memory/5068-2320-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/5068-2319-0x00000000054B0000-0x00000000054C2000-memory.dmp

Filesize
72KB

Download
memory/5068-2330-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/5068-2317-0x0000000005B60000-0x0000000006166000-memory.dmp

Filesize
6.0MB

Download
memory/5068-2332-0x00000000066D0000-0x0000000006720000-memory.dmp

Filesize
320KB

Download
memory/5068-2311-0x0000000002D90000-0x0000000002D96000-memory.dmp

Filesize
24KB

Download
memory/5068-2310-0x0000000000BB0000-0x0000000000BDE000-memory.dmp

Filesize
184KB

Download
memory/5100-142-0x0000000000780000-0x000000000078A000-memory.dmp

Filesize
40KB

Download