amadey | f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9

Analysis

max time kernel
142s
max time network
146s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
14-04-2023 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe
Size

1.0MB
MD5

9c4db766301eefe5e59e78d3b8e9f12e
SHA1

056b28c14fe29210e4378486b8949274b9a18a3d
SHA256

f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9
SHA512

f5ae511b56c86f83f79e55733ccf0bc022044c778930b5168a433d0e8be08a48308479ab6b5e6aeceae2c88d755f8abe56a86039682ebb28d289553ea7d8d6fa
SSDEEP

24576:AyLeh/F8K8CUK1a6LVRy/L9dbNa8250YneIolz2O5P7EPmjemZ:HLPKcKlLi9dNo/eBz2O5P4Pmjem

Score

10^/10

amadey redline disa lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

185.161.248.90:4125

Attributes

auth_value
93f8c4ca7000e3381dd4b6b86434de05

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

it437406.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it437406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it437406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it437406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it437406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it437406.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 7 IoCs

Processes:

ziBE3217.exeziZI0094.exeit437406.exejr109814.exe1.exekp177600.exelr035495.exe

pid process

4348 ziBE3217.exe
4876 ziZI0094.exe
2140 it437406.exe
416 jr109814.exe
1304 1.exe
2708 kp177600.exe
1884 lr035495.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

it437406.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it437406.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4348	ziBE3217.exe
4876	ziZI0094.exe
2140	it437406.exe
416	jr109814.exe
1304	1.exe
2708	kp177600.exe
1884	lr035495.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it437406.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exeziBE3217.exeziZI0094.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziBE3217.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziBE3217.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziZI0094.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziZI0094.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4820	1884	WerFault.exe	lr035495.exe
4836	1884	WerFault.exe	lr035495.exe
4216	1884	WerFault.exe	lr035495.exe
964	1884	WerFault.exe	lr035495.exe
1380	1884	WerFault.exe	lr035495.exe
2892	1884	WerFault.exe	lr035495.exe
4760	1884	WerFault.exe	lr035495.exe
4400	1884	WerFault.exe	lr035495.exe
1232	1884	WerFault.exe	lr035495.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

it437406.exe1.exekp177600.exe

pid process

2140 it437406.exe
2140 it437406.exe
1304 1.exe
2708 kp177600.exe
2708 kp177600.exe
1304 1.exe

pid	process
2140	it437406.exe
2140	it437406.exe
1304	1.exe
2708	kp177600.exe
2708	kp177600.exe
1304	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

it437406.exejr109814.exe1.exekp177600.exe

description	pid	process
Token: SeDebugPrivilege	2140	it437406.exe
Token: SeDebugPrivilege	416	jr109814.exe
Token: SeDebugPrivilege	1304	1.exe
Token: SeDebugPrivilege	2708	kp177600.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

lr035495.exe

pid process

1884 lr035495.exe

pid	process
1884	lr035495.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exeziBE3217.exeziZI0094.exejr109814.exe

description	pid	process	target process
PID 3992 wrote to memory of 4348	3992	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe	ziBE3217.exe
PID 3992 wrote to memory of 4348	3992	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe	ziBE3217.exe
PID 3992 wrote to memory of 4348	3992	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe	ziBE3217.exe
PID 4348 wrote to memory of 4876	4348	ziBE3217.exe	ziZI0094.exe
PID 4348 wrote to memory of 4876	4348	ziBE3217.exe	ziZI0094.exe
PID 4348 wrote to memory of 4876	4348	ziBE3217.exe	ziZI0094.exe
PID 4876 wrote to memory of 2140	4876	ziZI0094.exe	it437406.exe
PID 4876 wrote to memory of 2140	4876	ziZI0094.exe	it437406.exe
PID 4876 wrote to memory of 416	4876	ziZI0094.exe	jr109814.exe
PID 4876 wrote to memory of 416	4876	ziZI0094.exe	jr109814.exe
PID 4876 wrote to memory of 416	4876	ziZI0094.exe	jr109814.exe
PID 416 wrote to memory of 1304	416	jr109814.exe	1.exe
PID 416 wrote to memory of 1304	416	jr109814.exe	1.exe
PID 416 wrote to memory of 1304	416	jr109814.exe	1.exe
PID 4348 wrote to memory of 2708	4348	ziBE3217.exe	kp177600.exe
PID 4348 wrote to memory of 2708	4348	ziBE3217.exe	kp177600.exe
PID 4348 wrote to memory of 2708	4348	ziBE3217.exe	kp177600.exe
PID 3992 wrote to memory of 1884	3992	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe	lr035495.exe
PID 3992 wrote to memory of 1884	3992	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe	lr035495.exe
PID 3992 wrote to memory of 1884	3992	f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe	lr035495.exe

C:\Users\Admin\AppData\Local\Temp\f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe
"C:\Users\Admin\AppData\Local\Temp\f9849d3cef4b3b543463d4ac5a0f1b26c835d3fc3aaf99e4254a3bc8ae6a46a9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBE3217.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBE3217.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziZI0094.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziZI0094.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it437406.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it437406.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr109814.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr109814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:416
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp177600.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp177600.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr035495.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr035495.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 632
    3⤵
    - Program crash
    PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 708
    3⤵
    - Program crash
    PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 848
    3⤵
    - Program crash
    PID:4216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 836
    3⤵
    - Program crash
    PID:964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 884
    3⤵
    - Program crash
    PID:1380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 824
    3⤵
    - Program crash
    PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1120
    3⤵
    - Program crash
    PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1156
    3⤵
    - Program crash
    PID:4400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1088
    3⤵
    - Program crash
    PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr035495.exe

Filesize
396KB

MD5
2d5adc88b61f67dd4a3d0af63556a9b2

SHA1
be2a227a96abc93b9ae975d80e298b30f7397ff9

SHA256
1e48b404d2d2964a05cf261b6a76f91b598c699a5ab7964e182a287b812aa318

SHA512
e5d941a3ccc88562eb9e27795ad337a2aa8f52547a5f4d81f0e6a6be7d121ef1e1179246135ac869554f07605682c76024ca1bdf84910e1b593a445dd8f3986a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr035495.exe

Filesize
396KB

MD5
2d5adc88b61f67dd4a3d0af63556a9b2

SHA1
be2a227a96abc93b9ae975d80e298b30f7397ff9

SHA256
1e48b404d2d2964a05cf261b6a76f91b598c699a5ab7964e182a287b812aa318

SHA512
e5d941a3ccc88562eb9e27795ad337a2aa8f52547a5f4d81f0e6a6be7d121ef1e1179246135ac869554f07605682c76024ca1bdf84910e1b593a445dd8f3986a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBE3217.exe

Filesize
723KB

MD5
c41d0b372f792464d936eb4bd57a0d79

SHA1
602e325fb652f258b98fc4d8bd20ac62c315e000

SHA256
60d38b7eb8e2f45d34521d66f7e8d100ac39052c69e09c25574fa5cebc06de86

SHA512
8d1213c40998a9b7a02e8b173b94c9e86af6de2238ed269d9d48df19c7e3a46d81127db7ed57209a17aa35d07eff8e42906051e942258ccdd9f04c4e990d9250

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBE3217.exe

Filesize
723KB

MD5
c41d0b372f792464d936eb4bd57a0d79

SHA1
602e325fb652f258b98fc4d8bd20ac62c315e000

SHA256
60d38b7eb8e2f45d34521d66f7e8d100ac39052c69e09c25574fa5cebc06de86

SHA512
8d1213c40998a9b7a02e8b173b94c9e86af6de2238ed269d9d48df19c7e3a46d81127db7ed57209a17aa35d07eff8e42906051e942258ccdd9f04c4e990d9250

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp177600.exe

Filesize
169KB

MD5
acbfd8088adbc9d9bb771b099873d24a

SHA1
0e98b2723be2713aff59325620caccbfd7d6f185

SHA256
242bbe1f66f60eefb44ac0db0895c5150ed7218261537f2a0cdd463a33328273

SHA512
7324f75c1aaeb9a39b058a892a6be5e8626cf956bbb8705731dd139bf5835ec490d7203e7f030fdc457e30e8d66cd1103545c1ee50511b43f3e06326f61d8bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp177600.exe

Filesize
169KB

MD5
acbfd8088adbc9d9bb771b099873d24a

SHA1
0e98b2723be2713aff59325620caccbfd7d6f185

SHA256
242bbe1f66f60eefb44ac0db0895c5150ed7218261537f2a0cdd463a33328273

SHA512
7324f75c1aaeb9a39b058a892a6be5e8626cf956bbb8705731dd139bf5835ec490d7203e7f030fdc457e30e8d66cd1103545c1ee50511b43f3e06326f61d8bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziZI0094.exe

Filesize
569KB

MD5
3bea8d3815f500e29b8d4736dab803c3

SHA1
c7e5bc1783af62a263f4a43509137db5d652d1a8

SHA256
0a1a9c2a97fd6cb0e5c1839116125474182cb5a0bbbf9e0316b2379701f78a8a

SHA512
4448c250684a04d16b2720fddb42b45fc0d0691d42832909a4988da9eb09c5a8715bec4bdf4cef88754fbebb1ab776bdec11889acbca320fb42f906fed8ace69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziZI0094.exe

Filesize
569KB

MD5
3bea8d3815f500e29b8d4736dab803c3

SHA1
c7e5bc1783af62a263f4a43509137db5d652d1a8

SHA256
0a1a9c2a97fd6cb0e5c1839116125474182cb5a0bbbf9e0316b2379701f78a8a

SHA512
4448c250684a04d16b2720fddb42b45fc0d0691d42832909a4988da9eb09c5a8715bec4bdf4cef88754fbebb1ab776bdec11889acbca320fb42f906fed8ace69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it437406.exe

Filesize
11KB

MD5
3bddd3d94ca1082b3338368cfd684a60

SHA1
a02d9b07193c3b3f71cb6f63f352a2f2b6b35957

SHA256
b303c48001d61b947a4216a15893b110306cf29ace8e651978be88a193812a1a

SHA512
fcc6ec88cdc46e67971f7c163695b24233272518f696aba921031fdafa60307efb8cfd3f99349e8c35fd6289208edeba3643388a11f462b56ff918ebe745fbe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it437406.exe

Filesize
11KB

MD5
3bddd3d94ca1082b3338368cfd684a60

SHA1
a02d9b07193c3b3f71cb6f63f352a2f2b6b35957

SHA256
b303c48001d61b947a4216a15893b110306cf29ace8e651978be88a193812a1a

SHA512
fcc6ec88cdc46e67971f7c163695b24233272518f696aba921031fdafa60307efb8cfd3f99349e8c35fd6289208edeba3643388a11f462b56ff918ebe745fbe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr109814.exe

Filesize
587KB

MD5
c51f00afc7c2a905d389ce31265748d0

SHA1
ad9b73d2c4781751c810a9332c121b8377fee696

SHA256
10ce127748243be11fed4403db5ef88aa48da9f67c88367d4b90971aa8e69545

SHA512
f519b71af0b91f79df0f538fc1e0ecc065f53133ff091410d4d0f8c22d7084c1b35dd94d0f94842dcf014978305a2d421b26dc8c0571ee9c282dd714f05295c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr109814.exe

Filesize
587KB

MD5
c51f00afc7c2a905d389ce31265748d0

SHA1
ad9b73d2c4781751c810a9332c121b8377fee696

SHA256
10ce127748243be11fed4403db5ef88aa48da9f67c88367d4b90971aa8e69545

SHA512
f519b71af0b91f79df0f538fc1e0ecc065f53133ff091410d4d0f8c22d7084c1b35dd94d0f94842dcf014978305a2d421b26dc8c0571ee9c282dd714f05295c6

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
memory/416-188-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-202-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-147-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/416-148-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/416-149-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-150-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-152-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-154-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-156-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-158-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-160-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-162-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-164-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-166-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-168-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-170-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-172-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-174-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-176-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-178-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-180-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-182-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-184-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-186-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-145-0x00000000050B0000-0x0000000005116000-memory.dmp

Filesize
408KB

Download
memory/416-190-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-192-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-194-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-196-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-198-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-200-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-146-0x00000000009A0000-0x00000000009FB000-memory.dmp

Filesize
364KB

Download
memory/416-204-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-206-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-208-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-210-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-212-0x00000000050B0000-0x0000000005110000-memory.dmp

Filesize
384KB

Download
memory/416-2291-0x0000000005110000-0x0000000005142000-memory.dmp

Filesize
200KB

Download
memory/416-2293-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/416-143-0x0000000002580000-0x00000000025E8000-memory.dmp

Filesize
416KB

Download
memory/416-144-0x0000000005170000-0x000000000566E000-memory.dmp

Filesize
5.0MB

Download
memory/1304-2314-0x0000000005810000-0x0000000005886000-memory.dmp

Filesize
472KB

Download
memory/1304-2320-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/1304-2300-0x0000000000B80000-0x0000000000BAE000-memory.dmp

Filesize
184KB

Download
memory/1304-2316-0x0000000005890000-0x00000000058F6000-memory.dmp

Filesize
408KB

Download
memory/1304-2315-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/1304-2309-0x0000000005480000-0x0000000005492000-memory.dmp

Filesize
72KB

Download
memory/1304-2301-0x0000000005430000-0x0000000005436000-memory.dmp

Filesize
24KB

Download
memory/1304-2310-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/1304-2312-0x0000000005520000-0x000000000555E000-memory.dmp

Filesize
248KB

Download
memory/1304-2313-0x0000000005560000-0x00000000055AB000-memory.dmp

Filesize
300KB

Download
memory/1304-2319-0x00000000068C0000-0x0000000006910000-memory.dmp

Filesize
320KB

Download
memory/1304-2308-0x00000000055F0000-0x00000000056FA000-memory.dmp

Filesize
1.0MB

Download
memory/1884-2328-0x0000000000AA0000-0x0000000000ADB000-memory.dmp

Filesize
236KB

Download
memory/2140-137-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/2708-2307-0x000000000A5B0000-0x000000000ABB6000-memory.dmp

Filesize
6.0MB

Download
memory/2708-2317-0x000000000B9C0000-0x000000000BB82000-memory.dmp

Filesize
1.8MB

Download
memory/2708-2318-0x000000000C0C0000-0x000000000C5EC000-memory.dmp

Filesize
5.2MB

Download
memory/2708-2306-0x0000000002510000-0x0000000002516000-memory.dmp

Filesize
24KB

Download
memory/2708-2305-0x00000000002B0000-0x00000000002E0000-memory.dmp

Filesize
192KB

Download
memory/2708-2321-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/2708-2311-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download