amadey | d5f26b33c5be26a96d7273bc6df0dd38633a257cc53fe306ece9033265ede589

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2023, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12bbd4d9e132b6ebda36d2e978d001f2.exe
Size

556KB
MD5

12bbd4d9e132b6ebda36d2e978d001f2
SHA1

b56a7c39da0686845e34755e7c2dc3ff4c428a99
SHA256

d5f26b33c5be26a96d7273bc6df0dd38633a257cc53fe306ece9033265ede589
SHA512

f5a61ded8fc554a921085755edb0718ef69d1947d50ad57941c6f901541fd14ea202a350155e11abb317223726beac4de33003a9f66a74b5e894d35b224b2954
SSDEEP

12288:rMrky906AXcdEiSOPT4nZ5fp/f6y95S93kyhTP7E:XyZAsdLbPTOftfK9JfE

Score

10^/10

amadey healer redline micky dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

77.91.68.61/rock/index.php

Extracted

Family

redline

Botnet

micky

77.91.124.172:19071

Attributes

auth_value
748f3c67c004f4a994500f05127b4428

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231cc-152.dat	healer
behavioral2/files/0x00070000000231cc-153.dat	healer
behavioral2/memory/1460-154-0x00000000005C0000-0x00000000005CA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6811414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6811414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6811414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6811414.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k6811414.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6811414.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 8 IoCs

pid	Process
3008	y5349516.exe
1636	y4827033.exe
1460	k6811414.exe
4992	l1538837.exe
3932	pdates.exe
4880	m4658519.exe
840	pdates.exe
2380	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6811414.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	12bbd4d9e132b6ebda36d2e978d001f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5349516.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4827033.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4552	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	k6811414.exe
1460	k6811414.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	k6811414.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4992	l1538837.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 3008	4340	12bbd4d9e132b6ebda36d2e978d001f2.exe	83
PID 4340 wrote to memory of 3008	4340	12bbd4d9e132b6ebda36d2e978d001f2.exe	83
PID 4340 wrote to memory of 3008	4340	12bbd4d9e132b6ebda36d2e978d001f2.exe	83
PID 3008 wrote to memory of 1636	3008	y5349516.exe	84
PID 3008 wrote to memory of 1636	3008	y5349516.exe	84
PID 3008 wrote to memory of 1636	3008	y5349516.exe	84
PID 1636 wrote to memory of 1460	1636	y4827033.exe	86
PID 1636 wrote to memory of 1460	1636	y4827033.exe	86
PID 1636 wrote to memory of 4992	1636	y4827033.exe	97
PID 1636 wrote to memory of 4992	1636	y4827033.exe	97
PID 1636 wrote to memory of 4992	1636	y4827033.exe	97
PID 4992 wrote to memory of 3932	4992	l1538837.exe	98
PID 4992 wrote to memory of 3932	4992	l1538837.exe	98
PID 4992 wrote to memory of 3932	4992	l1538837.exe	98
PID 3008 wrote to memory of 4880	3008	y5349516.exe	99
PID 3008 wrote to memory of 4880	3008	y5349516.exe	99
PID 3008 wrote to memory of 4880	3008	y5349516.exe	99
PID 3932 wrote to memory of 1012	3932	pdates.exe	100
PID 3932 wrote to memory of 1012	3932	pdates.exe	100
PID 3932 wrote to memory of 1012	3932	pdates.exe	100
PID 3932 wrote to memory of 4428	3932	pdates.exe	102
PID 3932 wrote to memory of 4428	3932	pdates.exe	102
PID 3932 wrote to memory of 4428	3932	pdates.exe	102
PID 4428 wrote to memory of 2376	4428	cmd.exe	104
PID 4428 wrote to memory of 2376	4428	cmd.exe	104
PID 4428 wrote to memory of 2376	4428	cmd.exe	104
PID 4428 wrote to memory of 3184	4428	cmd.exe	105
PID 4428 wrote to memory of 3184	4428	cmd.exe	105
PID 4428 wrote to memory of 3184	4428	cmd.exe	105
PID 4428 wrote to memory of 1472	4428	cmd.exe	106
PID 4428 wrote to memory of 1472	4428	cmd.exe	106
PID 4428 wrote to memory of 1472	4428	cmd.exe	106
PID 4428 wrote to memory of 4320	4428	cmd.exe	108
PID 4428 wrote to memory of 4320	4428	cmd.exe	108
PID 4428 wrote to memory of 4320	4428	cmd.exe	108
PID 4428 wrote to memory of 964	4428	cmd.exe	107
PID 4428 wrote to memory of 964	4428	cmd.exe	107
PID 4428 wrote to memory of 964	4428	cmd.exe	107
PID 4428 wrote to memory of 4452	4428	cmd.exe	109
PID 4428 wrote to memory of 4452	4428	cmd.exe	109
PID 4428 wrote to memory of 4452	4428	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\12bbd4d9e132b6ebda36d2e978d001f2.exe
"C:\Users\Admin\AppData\Local\Temp\12bbd4d9e132b6ebda36d2e978d001f2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5349516.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5349516.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4827033.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4827033.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6811414.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6811414.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1538837.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1538837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1012
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        7⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        7⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        7⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        7⤵
        
        PID:4452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4658519.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4658519.exe
    3⤵
    - Executes dropped EXE
    PID:4880

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:840

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5349516.exe

Filesize
390KB

MD5
0c2bb5d272256653398c5b6f2e263955

SHA1
bc04774847b72c3749adb1873e310ca6ecbe55b2

SHA256
11ef5ed02db308aa7737fc35d7a03105b8a4f78d64a5cee89ab10ee725336ee9

SHA512
518e2adae8f58eadcbeddacd8c717dfe5016c902b26f1960d4072b15d52e535cba3dff0f615b758d572b1343257b6f84c7977c2de7cf6e6eeccecd0fab1747e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5349516.exe

Filesize
390KB

MD5
0c2bb5d272256653398c5b6f2e263955

SHA1
bc04774847b72c3749adb1873e310ca6ecbe55b2

SHA256
11ef5ed02db308aa7737fc35d7a03105b8a4f78d64a5cee89ab10ee725336ee9

SHA512
518e2adae8f58eadcbeddacd8c717dfe5016c902b26f1960d4072b15d52e535cba3dff0f615b758d572b1343257b6f84c7977c2de7cf6e6eeccecd0fab1747e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4658519.exe

Filesize
174KB

MD5
f3df9559dc6d6b1ff0c6d094449758bc

SHA1
0b1efe0d61d3e57b098d93b5758002d35ea66aa6

SHA256
556e40fb773139fa8a45e47b5a451fba61a4bbffdb343f959e2ead8273354390

SHA512
b6e25952ecf5d417e64a766be26ea5978e34e3e63c8ea4c0a3b69079fea02b707b24c39162e2f377bb515275c11bdbbc9a89d308ebc25197199d749044f21ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4658519.exe

Filesize
174KB

MD5
f3df9559dc6d6b1ff0c6d094449758bc

SHA1
0b1efe0d61d3e57b098d93b5758002d35ea66aa6

SHA256
556e40fb773139fa8a45e47b5a451fba61a4bbffdb343f959e2ead8273354390

SHA512
b6e25952ecf5d417e64a766be26ea5978e34e3e63c8ea4c0a3b69079fea02b707b24c39162e2f377bb515275c11bdbbc9a89d308ebc25197199d749044f21ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4827033.exe

Filesize
234KB

MD5
30366fe53b65ff8010dbccf86f24335c

SHA1
3d18a8d98ca3c571994ec31c38247639b3a487b4

SHA256
6724702eff5973713341ff07c6ca28f533516e10037c05df3f29e20e8fca25ef

SHA512
2314f82cddd164f1196ef34677339488f3a542fc0038dd640c1a1544468428ce42356d3ee0e477b2c8f4658b9ffb3ced6a45dad4ff103188981c499a7ffde207

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4827033.exe

Filesize
234KB

MD5
30366fe53b65ff8010dbccf86f24335c

SHA1
3d18a8d98ca3c571994ec31c38247639b3a487b4

SHA256
6724702eff5973713341ff07c6ca28f533516e10037c05df3f29e20e8fca25ef

SHA512
2314f82cddd164f1196ef34677339488f3a542fc0038dd640c1a1544468428ce42356d3ee0e477b2c8f4658b9ffb3ced6a45dad4ff103188981c499a7ffde207

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6811414.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6811414.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1538837.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1538837.exe

Filesize
223KB

MD5
aea234064483f651010cf9d981f59fea

SHA1
002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

SHA256
58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

SHA512
eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

Download Submit
memory/1460-154-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/1460-160-0x00007FFA1AA50000-0x00007FFA1B511000-memory.dmp

Filesize
10.8MB

Download
memory/1460-155-0x00007FFA1AA50000-0x00007FFA1B511000-memory.dmp

Filesize
10.8MB

Download
memory/4880-174-0x0000000000D20000-0x0000000000D50000-memory.dmp

Filesize
192KB

Download
memory/4880-175-0x0000000073C70000-0x0000000074420000-memory.dmp

Filesize
7.7MB

Download
memory/4880-176-0x0000000005D20000-0x0000000006338000-memory.dmp

Filesize
6.1MB

Download
memory/4880-177-0x0000000005810000-0x000000000591A000-memory.dmp

Filesize
1.0MB

Download
memory/4880-179-0x00000000056A0000-0x00000000056B2000-memory.dmp

Filesize
72KB

Download
memory/4880-178-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download
memory/4880-180-0x0000000005740000-0x000000000577C000-memory.dmp

Filesize
240KB

Download
memory/4880-181-0x0000000073C70000-0x0000000074420000-memory.dmp

Filesize
7.7MB

Download
memory/4880-182-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download