amadey | f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe
Size

755KB
MD5

053c3c8e722fa47bd2838b181c048d4f
SHA1

45a6adcdfc9dd036ca7edae5af73dfb8f51fb4fb
SHA256

0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd
SHA512

776b7eda980d98638096e170736cdfe4622e8fd2f6c8dda2c661c738ee201fcf4a048156f159b7dd3649713338e7e683a87bb9cf69115c02b630b4c68480835c
SSDEEP

12288:QMrhy90cINZiNM09CQ+yMCpfb5nIyt7s0zv4kma32U6yWy7P3RvcBLMxC++B+dGK:hyxI2uyMgN7sEmaLRx3cJ+dn

Score

10^/10

amadey healer mystic redline genda dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

genda

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral4/memory/2356-27-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral4/memory/2356-30-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral4/memory/2356-28-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral4/files/0x00080000000232a5-19.dat	healer
behavioral4/memory/4968-22-0x00000000005F0000-0x00000000005FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q6134869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q6134869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q6134869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q6134869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q6134869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q6134869.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/1436-34-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	t0352074.exe

Executes dropped EXE 9 IoCs

pid	Process
2876	z7768946.exe
660	z9327222.exe
4968	q6134869.exe
464	r8873344.exe
4256	s5765129.exe
3160	t0352074.exe
3836	explothe.exe
4084	explothe.exe
4088	explothe.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q6134869.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7768946.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9327222.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 464 set thread context of 2356	464	r8873344.exe	99
PID 4256 set thread context of 1436	4256	s5765129.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2188	464	WerFault.exe	94
4720	4256	WerFault.exe	104

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
64	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4968	q6134869.exe
4968	q6134869.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	q6134869.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2876	1964	0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe	91
PID 1964 wrote to memory of 2876	1964	0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe	91
PID 1964 wrote to memory of 2876	1964	0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe	91
PID 2876 wrote to memory of 660	2876	z7768946.exe	92
PID 2876 wrote to memory of 660	2876	z7768946.exe	92
PID 2876 wrote to memory of 660	2876	z7768946.exe	92
PID 660 wrote to memory of 4968	660	z9327222.exe	93
PID 660 wrote to memory of 4968	660	z9327222.exe	93
PID 660 wrote to memory of 464	660	z9327222.exe	94
PID 660 wrote to memory of 464	660	z9327222.exe	94
PID 660 wrote to memory of 464	660	z9327222.exe	94
PID 464 wrote to memory of 3056	464	r8873344.exe	96
PID 464 wrote to memory of 3056	464	r8873344.exe	96
PID 464 wrote to memory of 3056	464	r8873344.exe	96
PID 464 wrote to memory of 740	464	r8873344.exe	97
PID 464 wrote to memory of 740	464	r8873344.exe	97
PID 464 wrote to memory of 740	464	r8873344.exe	97
PID 464 wrote to memory of 1820	464	r8873344.exe	98
PID 464 wrote to memory of 1820	464	r8873344.exe	98
PID 464 wrote to memory of 1820	464	r8873344.exe	98
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 464 wrote to memory of 2356	464	r8873344.exe	99
PID 2876 wrote to memory of 4256	2876	z7768946.exe	104
PID 2876 wrote to memory of 4256	2876	z7768946.exe	104
PID 2876 wrote to memory of 4256	2876	z7768946.exe	104
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 4256 wrote to memory of 1436	4256	s5765129.exe	106
PID 1964 wrote to memory of 3160	1964	0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe	109
PID 1964 wrote to memory of 3160	1964	0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe	109
PID 1964 wrote to memory of 3160	1964	0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe	109
PID 3160 wrote to memory of 3836	3160	t0352074.exe	111
PID 3160 wrote to memory of 3836	3160	t0352074.exe	111
PID 3160 wrote to memory of 3836	3160	t0352074.exe	111
PID 3836 wrote to memory of 64	3836	explothe.exe	112
PID 3836 wrote to memory of 64	3836	explothe.exe	112
PID 3836 wrote to memory of 64	3836	explothe.exe	112
PID 3836 wrote to memory of 2336	3836	explothe.exe	114
PID 3836 wrote to memory of 2336	3836	explothe.exe	114
PID 3836 wrote to memory of 2336	3836	explothe.exe	114
PID 2336 wrote to memory of 4820	2336	cmd.exe	116
PID 2336 wrote to memory of 4820	2336	cmd.exe	116
PID 2336 wrote to memory of 4820	2336	cmd.exe	116
PID 2336 wrote to memory of 2528	2336	cmd.exe	117
PID 2336 wrote to memory of 2528	2336	cmd.exe	117
PID 2336 wrote to memory of 2528	2336	cmd.exe	117
PID 2336 wrote to memory of 4728	2336	cmd.exe	118
PID 2336 wrote to memory of 4728	2336	cmd.exe	118
PID 2336 wrote to memory of 4728	2336	cmd.exe	118
PID 2336 wrote to memory of 3920	2336	cmd.exe	119
PID 2336 wrote to memory of 3920	2336	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe
"C:\Users\Admin\AppData\Local\Temp\0edb945c8dd154bc423c54a58705917964bbfb8f0391f3350b75f33df5c740dd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7768946.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7768946.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9327222.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9327222.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\q6134869.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\q6134869.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r8873344.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r8873344.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3056
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:740
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:1820
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 612
        5⤵
        Program crash
        
        PID:2188
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5765129.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5765129.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 564
      4⤵
      Program crash
      PID:4720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0352074.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0352074.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
    "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:64
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4820
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        5⤵
        
        PID:2528
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        5⤵
        
        PID:4728
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3920
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        5⤵
        
        PID:4836
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        5⤵
        
        PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 464 -ip 464
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4256 -ip 4256
1⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3656

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4084

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0352074.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7768946.exe

Filesize
572KB

MD5
356b87f7e7d1119be9f7c887741a938b

SHA1
cecc1ad33fe7b36014f02b4fa44f515fd3249bf5

SHA256
ec316cbf3c14217146a8ba824b3c65ab244912ea81788f99b6cffb0ace82e471

SHA512
e3ff0d16b7e1e701ce3da63036330f68d852a81404eb978ce939c3f1901d6348898da229820e1937536a403dd5071174de1968d1d6df8a3f492dd82b40512c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5765129.exe

Filesize
386KB

MD5
d73886be4345e34cf4827fcb8a957cf4

SHA1
e1462c50683d4d0f8ec398ca1f9c8b62e1866823

SHA256
903ccb7a02e5c7b90cda143c57520d0ce32aff1859d47037c5c8763a7fe4365e

SHA512
9fa8e869eae791339743ce8950cf6baf99bab5e269284c667e04e8e9e46dd9868c0ff63a99cb8c4ec6aa9a845fd08875c1ddec4a717b1405b321b966aaa015d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9327222.exe

Filesize
309KB

MD5
2e4905aa800b199a194675fdfafc8b49

SHA1
f69b4fea9097cb4dc4d9185f4712afd347d0ee29

SHA256
78c46ce26624335d86d10014a51f6544018bcf6ffac94e3caa7d22984db07c59

SHA512
f550939e3880d94f29eb3e5d6537ea9ccb18f2a6e49a151822dfdf978515cadbc5f25d3518c0ae289a84cf341be95fec092ccf8e503105a75e2737f985234e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\q6134869.exe

Filesize
11KB

MD5
66233842cc4c6ffb85b56e67fece2373

SHA1
b38277717a66492ca9aa822ba760d26940bc5767

SHA256
d8d32c4b550eeb5c689f1424191f48be89b07453b0ca5753f4d19a544ebc0123

SHA512
8c7029f9079df2a839eb402c80b8656800ff07a5341930bc5f04494c1ae6777e35644c350ec6a45ffba4c34d1168416ed9ac9c351022241ef5371b08eff2c809

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r8873344.exe

Filesize
304KB

MD5
6fadd5e3de013d724ef45f2c1b157bcb

SHA1
6b826a70b3e01eb42b1cffecc6593d42adb10ddd

SHA256
4287e0b896754410651c0f7d0dec9e7d290d0b2b1cc38c5605f5920192424c85

SHA512
f4478bc5b1d71edc48e495f4f35ff6167ac02ac5f2a433b4c2eec57b6afce0e62fc832ce021f87eb80b4e16f7b1cb71daac2467a336801f56eb2dbbc19e91758

Download Submit
memory/1436-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1436-51-0x00000000078E0000-0x00000000079EA000-memory.dmp

Filesize
1.0MB

Download
memory/1436-54-0x0000000007890000-0x00000000078DC000-memory.dmp

Filesize
304KB

Download
memory/1436-53-0x0000000007850000-0x000000000788C000-memory.dmp

Filesize
240KB

Download
memory/1436-52-0x00000000077F0000-0x0000000007802000-memory.dmp

Filesize
72KB

Download
memory/1436-50-0x0000000008630000-0x0000000008C48000-memory.dmp

Filesize
6.1MB

Download
memory/1436-44-0x0000000007A60000-0x0000000008004000-memory.dmp

Filesize
5.6MB

Download
memory/1436-48-0x0000000007590000-0x0000000007622000-memory.dmp

Filesize
584KB

Download
memory/1436-49-0x0000000007580000-0x000000000758A000-memory.dmp

Filesize
40KB

Download
memory/2356-30-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2356-27-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2356-28-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4968-21-0x00007FF986E33000-0x00007FF986E35000-memory.dmp

Filesize
8KB

Download
memory/4968-22-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download