amadey | 5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2023, 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242.exe
Size

517KB
MD5

efdb116a508b8981beb1ee93e9814e13
SHA1

a283b81c5b134bb5b64bb696a1d4d3b165644666
SHA256

5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242
SHA512

be732bc90141eb20e8c3fc6b352e8d3917cd50434e9b370ce009bde48b626f8fa80217a7b1823ff6f20fb96cb910cc675fcb6369c7256fb20abc4a2028eee38f
SSDEEP

12288:jMrDy90MN/8sAdGiIDI+HJ2n0fV+5sw5XziADpcnW:sy/N/Pbc+HMn0NK5mgpcnW

Score

10^/10

amadey healer redline maxik dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

77.91.68.61/rock/index.php

Extracted

Family

redline

Botnet

maxik

77.91.124.156:19071

Attributes

auth_value
a7714e1bc167c67e3fc8f9e368352269

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x00080000000231e6-152.dat	healer
behavioral1/files/0x00080000000231e6-153.dat	healer
behavioral1/memory/4760-154-0x0000000000990000-0x000000000099A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5506987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5506987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5506987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5506987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5506987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5506987.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 8 IoCs

pid	Process
4136	y2240213.exe
3248	y5700032.exe
4760	k5506987.exe
4268	l8364606.exe
3784	pdates.exe
2888	m6721480.exe
4992	pdates.exe
2476	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5506987.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2240213.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5700032.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4760	k5506987.exe
4760	k5506987.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	k5506987.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4268	l8364606.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4136	1888	5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242.exe	85
PID 1888 wrote to memory of 4136	1888	5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242.exe	85
PID 1888 wrote to memory of 4136	1888	5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242.exe	85
PID 4136 wrote to memory of 3248	4136	y2240213.exe	86
PID 4136 wrote to memory of 3248	4136	y2240213.exe	86
PID 4136 wrote to memory of 3248	4136	y2240213.exe	86
PID 3248 wrote to memory of 4760	3248	y5700032.exe	87
PID 3248 wrote to memory of 4760	3248	y5700032.exe	87
PID 3248 wrote to memory of 4268	3248	y5700032.exe	92
PID 3248 wrote to memory of 4268	3248	y5700032.exe	92
PID 3248 wrote to memory of 4268	3248	y5700032.exe	92
PID 4268 wrote to memory of 3784	4268	l8364606.exe	93
PID 4268 wrote to memory of 3784	4268	l8364606.exe	93
PID 4268 wrote to memory of 3784	4268	l8364606.exe	93
PID 4136 wrote to memory of 2888	4136	y2240213.exe	94
PID 4136 wrote to memory of 2888	4136	y2240213.exe	94
PID 4136 wrote to memory of 2888	4136	y2240213.exe	94
PID 3784 wrote to memory of 3496	3784	pdates.exe	95
PID 3784 wrote to memory of 3496	3784	pdates.exe	95
PID 3784 wrote to memory of 3496	3784	pdates.exe	95
PID 3784 wrote to memory of 5060	3784	pdates.exe	97
PID 3784 wrote to memory of 5060	3784	pdates.exe	97
PID 3784 wrote to memory of 5060	3784	pdates.exe	97
PID 5060 wrote to memory of 1220	5060	cmd.exe	99
PID 5060 wrote to memory of 1220	5060	cmd.exe	99
PID 5060 wrote to memory of 1220	5060	cmd.exe	99
PID 5060 wrote to memory of 1660	5060	cmd.exe	100
PID 5060 wrote to memory of 1660	5060	cmd.exe	100
PID 5060 wrote to memory of 1660	5060	cmd.exe	100
PID 5060 wrote to memory of 2680	5060	cmd.exe	101
PID 5060 wrote to memory of 2680	5060	cmd.exe	101
PID 5060 wrote to memory of 2680	5060	cmd.exe	101
PID 5060 wrote to memory of 2740	5060	cmd.exe	102
PID 5060 wrote to memory of 2740	5060	cmd.exe	102
PID 5060 wrote to memory of 2740	5060	cmd.exe	102
PID 5060 wrote to memory of 736	5060	cmd.exe	103
PID 5060 wrote to memory of 736	5060	cmd.exe	103
PID 5060 wrote to memory of 736	5060	cmd.exe	103
PID 5060 wrote to memory of 5092	5060	cmd.exe	104
PID 5060 wrote to memory of 5092	5060	cmd.exe	104
PID 5060 wrote to memory of 5092	5060	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242.exe
"C:\Users\Admin\AppData\Local\Temp\5b768cdb49d6a7aed1e09a22acc37d160edd4bc1afcf3733ba5f52d2a2572242.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2240213.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2240213.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5700032.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5700032.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506987.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506987.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8364606.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8364606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3784
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3496
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:736
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:5092
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6721480.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6721480.exe
    3⤵
    - Executes dropped EXE
    PID:2888

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2240213.exe

Filesize
390KB

MD5
87727a750af53865d5a7da39ada1b2f1

SHA1
596a7f0d620a19fce7c51512fddf2a88f09874f2

SHA256
e1a8e0951edc09f7d64d317d8380fd93a87ae4dfeea9122a5636214bf669572e

SHA512
90f082cc4115c34e385af101b4fca911f5e4f0c341ab205255bc2a6e57f81a49ae161a994cd2fe43bf141e5a14d561bbd9b02ebe60cfc711d0c33142f17838a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2240213.exe

Filesize
390KB

MD5
87727a750af53865d5a7da39ada1b2f1

SHA1
596a7f0d620a19fce7c51512fddf2a88f09874f2

SHA256
e1a8e0951edc09f7d64d317d8380fd93a87ae4dfeea9122a5636214bf669572e

SHA512
90f082cc4115c34e385af101b4fca911f5e4f0c341ab205255bc2a6e57f81a49ae161a994cd2fe43bf141e5a14d561bbd9b02ebe60cfc711d0c33142f17838a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6721480.exe

Filesize
176KB

MD5
395a900f3e76055d65b0e4e1116d3807

SHA1
b5c1544ccbdeefd11aba39f8a997e3e248785d0f

SHA256
272fe84317126ba6b21b511e3f2f95d3dc94a21bdf4f6466dc7d4aef113e9f7b

SHA512
1a1e68bcb3d194225cdac67b1b2dba734e06600bcfa40371e470d2fa257817f56a77b49559000f844bb28222c82b25f861d9f7d36dd015c17b0e61e4784f6f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6721480.exe

Filesize
176KB

MD5
395a900f3e76055d65b0e4e1116d3807

SHA1
b5c1544ccbdeefd11aba39f8a997e3e248785d0f

SHA256
272fe84317126ba6b21b511e3f2f95d3dc94a21bdf4f6466dc7d4aef113e9f7b

SHA512
1a1e68bcb3d194225cdac67b1b2dba734e06600bcfa40371e470d2fa257817f56a77b49559000f844bb28222c82b25f861d9f7d36dd015c17b0e61e4784f6f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5700032.exe

Filesize
234KB

MD5
730fc0cfb877fa2ae5888d2f28f6d0bd

SHA1
ea8cc03eddb9ce983bcf2b28879b004a8ec6d1ae

SHA256
f5e6d59dfe685978e89cc8532413702d9d5178db2b117a0f665310f771cd7aa2

SHA512
42f14d8d26f731fa8c26188f9651b42dd9426ccfe09413bef35c07a482ce4a84328d14097ca18acf5772f5594baef84631cd55d66e15a4b6a2cc37cd6d846640

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5700032.exe

Filesize
234KB

MD5
730fc0cfb877fa2ae5888d2f28f6d0bd

SHA1
ea8cc03eddb9ce983bcf2b28879b004a8ec6d1ae

SHA256
f5e6d59dfe685978e89cc8532413702d9d5178db2b117a0f665310f771cd7aa2

SHA512
42f14d8d26f731fa8c26188f9651b42dd9426ccfe09413bef35c07a482ce4a84328d14097ca18acf5772f5594baef84631cd55d66e15a4b6a2cc37cd6d846640

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506987.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506987.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8364606.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8364606.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
memory/2888-176-0x0000000005550000-0x0000000005B68000-memory.dmp

Filesize
6.1MB

Download
memory/2888-174-0x0000000000500000-0x0000000000530000-memory.dmp

Filesize
192KB

Download
memory/2888-175-0x0000000073230000-0x00000000739E0000-memory.dmp

Filesize
7.7MB

Download
memory/2888-177-0x0000000005080000-0x000000000518A000-memory.dmp

Filesize
1.0MB

Download
memory/2888-178-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/2888-179-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/2888-180-0x0000000005020000-0x000000000505C000-memory.dmp

Filesize
240KB

Download
memory/2888-181-0x0000000073230000-0x00000000739E0000-memory.dmp

Filesize
7.7MB

Download
memory/2888-182-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/4760-157-0x00007FFDBFF80000-0x00007FFDC0A41000-memory.dmp

Filesize
10.8MB

Download
memory/4760-155-0x00007FFDBFF80000-0x00007FFDC0A41000-memory.dmp

Filesize
10.8MB

Download
memory/4760-154-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download