Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2024 14:52

General

  • Target

    1afc28ea1bc0fea812e0dc6fb291cf8d872d9bd94cf6b11cdac7c950ffa1c4de.exe

  • Size

    790KB

  • MD5

    bf7cf2cfacb88b527e232a5fb2556b9c

  • SHA1

    d8cd7688c28bea013219f5b54eeb3fd34a8c7845

  • SHA256

    1afc28ea1bc0fea812e0dc6fb291cf8d872d9bd94cf6b11cdac7c950ffa1c4de

  • SHA512

    53c64fa527dc134699cd03c7c29c4b7f969aa2b54e9da99d993601cb0822ea98546f2a9b2f8d77817190cae6940ca37f6c99386a8c48d5d7de64863b78cca8eb

  • SSDEEP

    24576:6HwAmKbUInVwQEsiK37Lem9snSNrU0W0R3xE:6NmK9nVlV3mm9sniguZxE

Malware Config

Extracted

Family

amadey

Version

4.15

C2

http://185.215.113.68

Attributes
  • install_dir

    d887ceb89d

  • install_file

    explorhe.exe

  • strings_key

    7cadc181267fafff9df8503e730d60e1

  • url_paths

    /theme/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1afc28ea1bc0fea812e0dc6fb291cf8d872d9bd94cf6b11cdac7c950ffa1c4de.exe
    "C:\Users\Admin\AppData\Local\Temp\1afc28ea1bc0fea812e0dc6fb291cf8d872d9bd94cf6b11cdac7c950ffa1c4de.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
      "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:3856
      • C:\Users\Admin\AppData\Local\Temp\1000958001\amert.exe
        "C:\Users\Admin\AppData\Local\Temp\1000958001\amert.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        PID:2304
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorhe.exe" && timeout 1 && del "explorhe.exe" && ren cbfcbf explorhe.exe && C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe && Exit"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1236
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im "explorhe.exe"
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1484
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          4⤵
          • Delays execution with timeout.exe
          PID:948
        • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
          C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3364
          • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
            "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2256
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:4704
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                7⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4832
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  8⤵
                    PID:3900
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\683043812824_Desktop.zip' -CompressionLevel Optimal
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5012
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                6⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                PID:228
    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1080
    • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
      C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3144
    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:392
    • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
      C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3432

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1000958001\amert.exe

      Filesize

      1.9MB

      MD5

      bb549aea2d5bda85420c444d35caaa9f

      SHA1

      0eed639585177d70472e9b771001fa335244db2a

      SHA256

      c4a5f684b01da61022349af3fb86ecc9ae4e62fda54d451be65b304296ccb9ea

      SHA512

      b8286d25564a318e8a91e55302be00ca17b8dd6ef968db58377bb9591b029bfa226dc8eb1994d1160efdc11c19978c95765298bc7189e0655df89c09f332eb5e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4dwavl35.pvp.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe

      Filesize

      790KB

      MD5

      bf7cf2cfacb88b527e232a5fb2556b9c

      SHA1

      d8cd7688c28bea013219f5b54eeb3fd34a8c7845

      SHA256

      1afc28ea1bc0fea812e0dc6fb291cf8d872d9bd94cf6b11cdac7c950ffa1c4de

      SHA512

      53c64fa527dc134699cd03c7c29c4b7f969aa2b54e9da99d993601cb0822ea98546f2a9b2f8d77817190cae6940ca37f6c99386a8c48d5d7de64863b78cca8eb

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

      Filesize

      109KB

      MD5

      2afdbe3b99a4736083066a13e4b5d11a

      SHA1

      4d4856cf02b3123ac16e63d4a448cdbcb1633546

      SHA256

      8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

      SHA512

      d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

      Filesize

      1.2MB

      MD5

      92fbdfccf6a63acef2743631d16652a7

      SHA1

      971968b1378dd89d59d7f84bf92f16fc68664506

      SHA256

      b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

      SHA512

      b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

    • C:\Windows\Tasks\explorgu.job

      Filesize

      288B

      MD5

      eb56f4c906829c8de1f5ec5c35c71739

      SHA1

      f51290b811d70c52e3d164fb55442a4a746b8c98

      SHA256

      66f5c7c6e266be07dd5df23736014778038bf4aadf9ee2ad15a5c82b25f4f335

      SHA512

      8d5bb60b7172bf8c090763c877f7e2a8e86e1f1101c1028355e5294e55bf394526d1274e636155f349ea82fc84c4b71ef7a15c4b6adfe0304eb52632fe59b3de

    • \??\c:\users\admin\appdata\local\temp\F59E91F8

      Filesize

      14B

      MD5

      eec049d8f950563d7af89d1dd1cd11a8

      SHA1

      a3a40bac1de9121d4b84930fb04e13a5290177c9

      SHA256

      605215fdf90d6e9f24c0bcc9c7344b806ccd91e3b371ba816f0e485ebae00f71

      SHA512

      5b60a8e196c529b43e864cb3abe5a997954b71bb04e40b230b524e2abd7fd809c1959030dd11f1dc98bff2a1231b1a1382e4f61caee156798305f07e70ed9463

    • memory/392-185-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/392-169-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/392-168-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/1080-150-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/1080-149-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

      Filesize

      4KB

    • memory/1080-147-0x0000000004F30000-0x0000000004F31000-memory.dmp

      Filesize

      4KB

    • memory/1080-148-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

      Filesize

      4KB

    • memory/1080-144-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

      Filesize

      4KB

    • memory/1080-146-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

      Filesize

      4KB

    • memory/1080-145-0x0000000004F00000-0x0000000004F01000-memory.dmp

      Filesize

      4KB

    • memory/1080-143-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/1080-142-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/1472-16-0x0000000000950000-0x0000000000D58000-memory.dmp

      Filesize

      4.0MB

    • memory/1472-2-0x0000000000950000-0x0000000000D58000-memory.dmp

      Filesize

      4.0MB

    • memory/1472-1-0x0000000000950000-0x0000000000D58000-memory.dmp

      Filesize

      4.0MB

    • memory/1472-0-0x0000000000950000-0x0000000000D58000-memory.dmp

      Filesize

      4.0MB

    • memory/2256-89-0x0000000004A80000-0x0000000004A81000-memory.dmp

      Filesize

      4KB

    • memory/2256-127-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-190-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-189-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-188-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-187-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-166-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-165-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-164-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-163-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-162-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-79-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-161-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-80-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-81-0x0000000004A30000-0x0000000004A31000-memory.dmp

      Filesize

      4KB

    • memory/2256-82-0x0000000004A40000-0x0000000004A41000-memory.dmp

      Filesize

      4KB

    • memory/2256-83-0x0000000004A20000-0x0000000004A21000-memory.dmp

      Filesize

      4KB

    • memory/2256-84-0x0000000004A70000-0x0000000004A71000-memory.dmp

      Filesize

      4KB

    • memory/2256-85-0x0000000004A00000-0x0000000004A01000-memory.dmp

      Filesize

      4KB

    • memory/2256-86-0x0000000004A10000-0x0000000004A11000-memory.dmp

      Filesize

      4KB

    • memory/2256-87-0x0000000004A60000-0x0000000004A61000-memory.dmp

      Filesize

      4KB

    • memory/2256-88-0x0000000004A90000-0x0000000004A91000-memory.dmp

      Filesize

      4KB

    • memory/2256-140-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-90-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-139-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-126-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2256-115-0x0000000000510000-0x00000000009D8000-memory.dmp

      Filesize

      4.8MB

    • memory/2304-61-0x0000000000A90000-0x0000000000F58000-memory.dmp

      Filesize

      4.8MB

    • memory/2304-36-0x0000000000A90000-0x0000000000F58000-memory.dmp

      Filesize

      4.8MB

    • memory/2304-47-0x0000000004E50000-0x0000000004E51000-memory.dmp

      Filesize

      4KB

    • memory/2304-46-0x0000000077124000-0x0000000077126000-memory.dmp

      Filesize

      8KB

    • memory/2304-48-0x0000000004E60000-0x0000000004E61000-memory.dmp

      Filesize

      4KB

    • memory/2304-49-0x0000000004E40000-0x0000000004E41000-memory.dmp

      Filesize

      4KB

    • memory/2304-50-0x0000000004E80000-0x0000000004E81000-memory.dmp

      Filesize

      4KB

    • memory/2304-51-0x0000000004E20000-0x0000000004E21000-memory.dmp

      Filesize

      4KB

    • memory/2304-55-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

      Filesize

      4KB

    • memory/2304-52-0x0000000004E30000-0x0000000004E31000-memory.dmp

      Filesize

      4KB

    • memory/2304-53-0x0000000000A90000-0x0000000000F58000-memory.dmp

      Filesize

      4.8MB

    • memory/2304-57-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

      Filesize

      4KB

    • memory/3144-152-0x0000000000740000-0x0000000000C08000-memory.dmp

      Filesize

      4.8MB

    • memory/3144-156-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

      Filesize

      4KB

    • memory/3144-160-0x0000000000740000-0x0000000000C08000-memory.dmp

      Filesize

      4.8MB

    • memory/3144-154-0x0000000004B00000-0x0000000004B01000-memory.dmp

      Filesize

      4KB

    • memory/3144-157-0x0000000004B30000-0x0000000004B31000-memory.dmp

      Filesize

      4KB

    • memory/3144-158-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

      Filesize

      4KB

    • memory/3144-159-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

      Filesize

      4KB

    • memory/3144-155-0x0000000004B10000-0x0000000004B11000-memory.dmp

      Filesize

      4KB

    • memory/3144-153-0x0000000000740000-0x0000000000C08000-memory.dmp

      Filesize

      4.8MB

    • memory/3364-71-0x00000000050F0000-0x00000000050F1000-memory.dmp

      Filesize

      4KB

    • memory/3364-73-0x0000000005130000-0x0000000005131000-memory.dmp

      Filesize

      4KB

    • memory/3364-69-0x00000000050B0000-0x00000000050B1000-memory.dmp

      Filesize

      4KB

    • memory/3364-70-0x00000000050C0000-0x00000000050C1000-memory.dmp

      Filesize

      4KB

    • memory/3364-68-0x0000000005110000-0x0000000005111000-memory.dmp

      Filesize

      4KB

    • memory/3364-67-0x00000000050D0000-0x00000000050D1000-memory.dmp

      Filesize

      4KB

    • memory/3364-75-0x0000000005120000-0x0000000005121000-memory.dmp

      Filesize

      4KB

    • memory/3364-66-0x00000000050E0000-0x00000000050E1000-memory.dmp

      Filesize

      4KB

    • memory/3364-65-0x0000000000740000-0x0000000000C08000-memory.dmp

      Filesize

      4.8MB

    • memory/3364-78-0x0000000000740000-0x0000000000C08000-memory.dmp

      Filesize

      4.8MB

    • memory/3364-64-0x0000000000740000-0x0000000000C08000-memory.dmp

      Filesize

      4.8MB

    • memory/3432-186-0x0000000000740000-0x0000000000C08000-memory.dmp

      Filesize

      4.8MB

    • memory/4884-17-0x0000000000F40000-0x0000000001348000-memory.dmp

      Filesize

      4.0MB

    • memory/4884-54-0x0000000000F40000-0x0000000001348000-memory.dmp

      Filesize

      4.0MB

    • memory/4884-15-0x0000000000F40000-0x0000000001348000-memory.dmp

      Filesize

      4.0MB

    • memory/4884-14-0x0000000000F40000-0x0000000001348000-memory.dmp

      Filesize

      4.0MB

    • memory/5012-113-0x00007FF907E80000-0x00007FF908941000-memory.dmp

      Filesize

      10.8MB

    • memory/5012-114-0x000001E09F140000-0x000001E09F150000-memory.dmp

      Filesize

      64KB

    • memory/5012-112-0x000001E086F40000-0x000001E086F62000-memory.dmp

      Filesize

      136KB

    • memory/5012-116-0x000001E09F140000-0x000001E09F150000-memory.dmp

      Filesize

      64KB

    • memory/5012-117-0x000001E09F140000-0x000001E09F150000-memory.dmp

      Filesize

      64KB

    • memory/5012-118-0x000001E09F0E0000-0x000001E09F0F2000-memory.dmp

      Filesize

      72KB

    • memory/5012-119-0x000001E09F0D0000-0x000001E09F0DA000-memory.dmp

      Filesize

      40KB

    • memory/5012-125-0x00007FF907E80000-0x00007FF908941000-memory.dmp

      Filesize

      10.8MB