amadey | e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2023, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe
Size

492KB
MD5

84b31f0ba80b863b961aa8285a590d48
SHA1

81bd5efa86dc9f307560d6df6d60f3eda99fb2cc
SHA256

e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473
SHA512

b63fd87240e827d627f3b3931329fdb4bebefd6b1b03a095fc3fa6269e218515ecb3193cb8ad51b42bf12a83b2928c96dff4ccea64301c680ca7c6746b59c355
SSDEEP

12288:bMr8y90i+gO2bSfpf0t1I8TJgRlqV7dbbPAXiwBq:HyzbUMt11iEVRAXiwBq

Score

10^/10

amadey redline luna discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

luna

217.196.96.101:4132

Attributes

auth_value
3372be6f6fa192ff878fa6fe9be73f6e

Extracted

Family

amadey

Version

3.70

212.113.119.255/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o2293581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o2293581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o2293581.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o2293581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o2293581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o2293581.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	s6685049.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 7 IoCs

pid	Process
1100	z1868160.exe
4840	o2293581.exe
2540	r3044276.exe
4680	s6685049.exe
4620	oneetx.exe
2860	oneetx.exe
3720	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
4264	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o2293581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o2293581.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1868160.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1868160.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4840	o2293581.exe
4840	o2293581.exe
2540	r3044276.exe
2540	r3044276.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	o2293581.exe
Token: SeDebugPrivilege	2540	r3044276.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4680	s6685049.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1100	2560	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe	85
PID 2560 wrote to memory of 1100	2560	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe	85
PID 2560 wrote to memory of 1100	2560	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe	85
PID 1100 wrote to memory of 4840	1100	z1868160.exe	86
PID 1100 wrote to memory of 4840	1100	z1868160.exe	86
PID 1100 wrote to memory of 4840	1100	z1868160.exe	86
PID 1100 wrote to memory of 2540	1100	z1868160.exe	93
PID 1100 wrote to memory of 2540	1100	z1868160.exe	93
PID 1100 wrote to memory of 2540	1100	z1868160.exe	93
PID 2560 wrote to memory of 4680	2560	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe	96
PID 2560 wrote to memory of 4680	2560	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe	96
PID 2560 wrote to memory of 4680	2560	e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe	96
PID 4680 wrote to memory of 4620	4680	s6685049.exe	97
PID 4680 wrote to memory of 4620	4680	s6685049.exe	97
PID 4680 wrote to memory of 4620	4680	s6685049.exe	97
PID 4620 wrote to memory of 1284	4620	oneetx.exe	98
PID 4620 wrote to memory of 1284	4620	oneetx.exe	98
PID 4620 wrote to memory of 1284	4620	oneetx.exe	98
PID 4620 wrote to memory of 4264	4620	oneetx.exe	101
PID 4620 wrote to memory of 4264	4620	oneetx.exe	101
PID 4620 wrote to memory of 4264	4620	oneetx.exe	101

C:\Users\Admin\AppData\Local\Temp\e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe
"C:\Users\Admin\AppData\Local\Temp\e2887f7aa8f1414494e1811d62cd429e26d5dffb94f2bef873203a4db4c4b473.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1868160.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1868160.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o2293581.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o2293581.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3044276.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3044276.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6685049.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6685049.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1284
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4264

C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
1⤵
- Executes dropped EXE
PID:2860

C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
1⤵
- Executes dropped EXE
PID:3720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

Filesize
230KB

MD5
9de946e9d62788b6b17b3ad1186cda37

SHA1
c9a2f236bbe76d40236594c13165cfcd73721476

SHA256
eeac15c5d420e9be61a9ffdbba51da2081edb515b3d99ad8d174385c105990b9

SHA512
4782b9095fedf5f1b27e440d71b6f1721157215e58910dd7bc9933e459e6e0518df9523daf91fc574efc583f9ffcad0e349de714ead8e25572cc7ba24310d400

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

Filesize
230KB

MD5
9de946e9d62788b6b17b3ad1186cda37

SHA1
c9a2f236bbe76d40236594c13165cfcd73721476

SHA256
eeac15c5d420e9be61a9ffdbba51da2081edb515b3d99ad8d174385c105990b9

SHA512
4782b9095fedf5f1b27e440d71b6f1721157215e58910dd7bc9933e459e6e0518df9523daf91fc574efc583f9ffcad0e349de714ead8e25572cc7ba24310d400

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

Filesize
230KB

MD5
9de946e9d62788b6b17b3ad1186cda37

SHA1
c9a2f236bbe76d40236594c13165cfcd73721476

SHA256
eeac15c5d420e9be61a9ffdbba51da2081edb515b3d99ad8d174385c105990b9

SHA512
4782b9095fedf5f1b27e440d71b6f1721157215e58910dd7bc9933e459e6e0518df9523daf91fc574efc583f9ffcad0e349de714ead8e25572cc7ba24310d400

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

Filesize
230KB

MD5
9de946e9d62788b6b17b3ad1186cda37

SHA1
c9a2f236bbe76d40236594c13165cfcd73721476

SHA256
eeac15c5d420e9be61a9ffdbba51da2081edb515b3d99ad8d174385c105990b9

SHA512
4782b9095fedf5f1b27e440d71b6f1721157215e58910dd7bc9933e459e6e0518df9523daf91fc574efc583f9ffcad0e349de714ead8e25572cc7ba24310d400

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

Filesize
230KB

MD5
9de946e9d62788b6b17b3ad1186cda37

SHA1
c9a2f236bbe76d40236594c13165cfcd73721476

SHA256
eeac15c5d420e9be61a9ffdbba51da2081edb515b3d99ad8d174385c105990b9

SHA512
4782b9095fedf5f1b27e440d71b6f1721157215e58910dd7bc9933e459e6e0518df9523daf91fc574efc583f9ffcad0e349de714ead8e25572cc7ba24310d400

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6685049.exe

Filesize
230KB

MD5
9de946e9d62788b6b17b3ad1186cda37

SHA1
c9a2f236bbe76d40236594c13165cfcd73721476

SHA256
eeac15c5d420e9be61a9ffdbba51da2081edb515b3d99ad8d174385c105990b9

SHA512
4782b9095fedf5f1b27e440d71b6f1721157215e58910dd7bc9933e459e6e0518df9523daf91fc574efc583f9ffcad0e349de714ead8e25572cc7ba24310d400

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6685049.exe

Filesize
230KB

MD5
9de946e9d62788b6b17b3ad1186cda37

SHA1
c9a2f236bbe76d40236594c13165cfcd73721476

SHA256
eeac15c5d420e9be61a9ffdbba51da2081edb515b3d99ad8d174385c105990b9

SHA512
4782b9095fedf5f1b27e440d71b6f1721157215e58910dd7bc9933e459e6e0518df9523daf91fc574efc583f9ffcad0e349de714ead8e25572cc7ba24310d400

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1868160.exe

Filesize
309KB

MD5
bac541a9e433aab727cbe7b12fd12def

SHA1
5ab1a4ded39bc8b13dcae4e65b428dd10ad8bacf

SHA256
3efca9449a98600b374d08584722e5415cb801c7833d931788dc4e7fc51695b4

SHA512
d351f890f98e270c70874d88bc908ab751b7678a84e59bc9a94617ff074db84219ba3b325f017a2cce474b80088d1cb1e5586d06c18cefbee94dbdbe60c10610

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1868160.exe

Filesize
309KB

MD5
bac541a9e433aab727cbe7b12fd12def

SHA1
5ab1a4ded39bc8b13dcae4e65b428dd10ad8bacf

SHA256
3efca9449a98600b374d08584722e5415cb801c7833d931788dc4e7fc51695b4

SHA512
d351f890f98e270c70874d88bc908ab751b7678a84e59bc9a94617ff074db84219ba3b325f017a2cce474b80088d1cb1e5586d06c18cefbee94dbdbe60c10610

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o2293581.exe

Filesize
176KB

MD5
2a02442fd8f21c08686be998a7399412

SHA1
aa19bce0ae14dd95847421aaed4db0e50f134b28

SHA256
1e1525ffd32483cfc0f5e28d97ee9c7b19315acea9aa9380fd8f40002c232788

SHA512
713ab1b145ce6fa3a0313aa776bc50565c9a4ffaf2976023aefd99614a6b7e3e4c6b3abf89187c3377f4dea0efcde5402118b8e9b87dd0af61f2973bf073beb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o2293581.exe

Filesize
176KB

MD5
2a02442fd8f21c08686be998a7399412

SHA1
aa19bce0ae14dd95847421aaed4db0e50f134b28

SHA256
1e1525ffd32483cfc0f5e28d97ee9c7b19315acea9aa9380fd8f40002c232788

SHA512
713ab1b145ce6fa3a0313aa776bc50565c9a4ffaf2976023aefd99614a6b7e3e4c6b3abf89187c3377f4dea0efcde5402118b8e9b87dd0af61f2973bf073beb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3044276.exe

Filesize
168KB

MD5
c2d5990b6d39d440dbe883882aabc7fb

SHA1
cb0dabecd6e3c7bfc1fb19ab5773be44b261ae6f

SHA256
b1897addc29cd04c0ef916e171248c133eb7b4b74a66500678667b7a0ddd26de

SHA512
1971d18d48648785b8a21483a06399e77ad2a7c7cca1ff3d09eabe239fecb9e54acc924f560b1c64ab4534d9cc1f7e52fe3e7c122a79c102e7ef03e29f86a56f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3044276.exe

Filesize
168KB

MD5
c2d5990b6d39d440dbe883882aabc7fb

SHA1
cb0dabecd6e3c7bfc1fb19ab5773be44b261ae6f

SHA256
b1897addc29cd04c0ef916e171248c133eb7b4b74a66500678667b7a0ddd26de

SHA512
1971d18d48648785b8a21483a06399e77ad2a7c7cca1ff3d09eabe239fecb9e54acc924f560b1c64ab4534d9cc1f7e52fe3e7c122a79c102e7ef03e29f86a56f

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73df88d68a4f5e066784d462788cf695

SHA1
e4bfed336848d0b622fa464d40cf4bd9222aab3f

SHA256
f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

SHA512
64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73df88d68a4f5e066784d462788cf695

SHA1
e4bfed336848d0b622fa464d40cf4bd9222aab3f

SHA256
f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

SHA512
64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
73df88d68a4f5e066784d462788cf695

SHA1
e4bfed336848d0b622fa464d40cf4bd9222aab3f

SHA256
f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

SHA512
64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2540-195-0x0000000005E10000-0x0000000005E60000-memory.dmp

Filesize
320KB

Download
memory/2540-196-0x0000000006030000-0x00000000061F2000-memory.dmp

Filesize
1.8MB

Download
memory/2540-194-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/2540-193-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/2540-192-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/2540-191-0x0000000004E80000-0x0000000004EF6000-memory.dmp

Filesize
472KB

Download
memory/2540-190-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/2540-189-0x0000000004B80000-0x0000000004BBC000-memory.dmp

Filesize
240KB

Download
memory/2540-197-0x00000000083F0000-0x000000000891C000-memory.dmp

Filesize
5.2MB

Download
memory/2540-188-0x0000000004B00000-0x0000000004B12000-memory.dmp

Filesize
72KB

Download
memory/2540-185-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/2540-186-0x0000000005160000-0x0000000005778000-memory.dmp

Filesize
6.1MB

Download
memory/2540-187-0x0000000004C50000-0x0000000004D5A000-memory.dmp

Filesize
1.0MB

Download
memory/4840-158-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-180-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/4840-179-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/4840-178-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-176-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-174-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-172-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-170-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-168-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-166-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-164-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-162-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-160-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-156-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-154-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-152-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-151-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4840-150-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/4840-149-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/4840-148-0x00000000049A0000-0x0000000004F44000-memory.dmp

Filesize
5.6MB

Download
memory/4840-147-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download