amadey | b0775c8fcdd8ebb0123f9b03757952498595475777fac3bbde3e90ed10d13558

Analysis

max time kernel
156s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe
Size

641KB
MD5

1d0fbd5c41a0aef56f28e1c20d10e394
SHA1

aabbe503a0cd0511597bcfdd4df77993b1af0f76
SHA256

b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032
SHA512

fed895eb492ae6994d0dcaa145e779bf46bd7cd92b98fa1f14e35f7fc3ed63a070877d2b56893393425576853510600fe99b4a7b2f13f2bab56396d4b7dd1c7c
SSDEEP

12288:QMrey90Wa5yBOAdL1yBrSFbUhlBXxs8SHlaCYYMrk6SpoBeaKVl:eyFaEgAEhvJSHECYApIWl

Score

10^/10

amadey healer redline smokeloader papik backdoor dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117
url_paths
/rock/index.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

papik

77.91.124.156:19071

Attributes

auth_value
325a615d8be5db8e2f7a4c2448fdac3a

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral14/files/0x0008000000023261-27.dat	healer
behavioral14/memory/1180-28-0x00000000008E0000-0x00000000008EA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a4475769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4475769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4475769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4475769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4475769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4475769.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral14/files/0x000700000002325c-52.dat	family_redline
behavioral14/memory/3356-54-0x0000000000270000-0x00000000002A0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	b5727213.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 10 IoCs

pid	Process
2708	v1769708.exe
2420	v4782366.exe
4848	v7478463.exe
1180	a4475769.exe
3684	b5727213.exe
2692	pdates.exe
3404	c2075048.exe
3356	d5091095.exe
4512	pdates.exe
2060	pdates.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4475769.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1769708.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4782366.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v7478463.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2075048.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2075048.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2075048.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1180	a4475769.exe
1180	a4475769.exe
3404	c2075048.exe
3404	c2075048.exe
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3404	c2075048.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	a4475769.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3684	b5727213.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2708	4596	b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe	91
PID 4596 wrote to memory of 2708	4596	b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe	91
PID 4596 wrote to memory of 2708	4596	b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe	91
PID 2708 wrote to memory of 2420	2708	v1769708.exe	92
PID 2708 wrote to memory of 2420	2708	v1769708.exe	92
PID 2708 wrote to memory of 2420	2708	v1769708.exe	92
PID 2420 wrote to memory of 4848	2420	v4782366.exe	93
PID 2420 wrote to memory of 4848	2420	v4782366.exe	93
PID 2420 wrote to memory of 4848	2420	v4782366.exe	93
PID 4848 wrote to memory of 1180	4848	v7478463.exe	94
PID 4848 wrote to memory of 1180	4848	v7478463.exe	94
PID 4848 wrote to memory of 3684	4848	v7478463.exe	97
PID 4848 wrote to memory of 3684	4848	v7478463.exe	97
PID 4848 wrote to memory of 3684	4848	v7478463.exe	97
PID 3684 wrote to memory of 2692	3684	b5727213.exe	99
PID 3684 wrote to memory of 2692	3684	b5727213.exe	99
PID 3684 wrote to memory of 2692	3684	b5727213.exe	99
PID 2420 wrote to memory of 3404	2420	v4782366.exe	100
PID 2420 wrote to memory of 3404	2420	v4782366.exe	100
PID 2420 wrote to memory of 3404	2420	v4782366.exe	100
PID 2692 wrote to memory of 5028	2692	pdates.exe	101
PID 2692 wrote to memory of 5028	2692	pdates.exe	101
PID 2692 wrote to memory of 5028	2692	pdates.exe	101
PID 2692 wrote to memory of 2576	2692	pdates.exe	103
PID 2692 wrote to memory of 2576	2692	pdates.exe	103
PID 2692 wrote to memory of 2576	2692	pdates.exe	103
PID 2576 wrote to memory of 2716	2576	cmd.exe	105
PID 2576 wrote to memory of 2716	2576	cmd.exe	105
PID 2576 wrote to memory of 2716	2576	cmd.exe	105
PID 2576 wrote to memory of 4236	2576	cmd.exe	106
PID 2576 wrote to memory of 4236	2576	cmd.exe	106
PID 2576 wrote to memory of 4236	2576	cmd.exe	106
PID 2576 wrote to memory of 3660	2576	cmd.exe	107
PID 2576 wrote to memory of 3660	2576	cmd.exe	107
PID 2576 wrote to memory of 3660	2576	cmd.exe	107
PID 2576 wrote to memory of 4792	2576	cmd.exe	108
PID 2576 wrote to memory of 4792	2576	cmd.exe	108
PID 2576 wrote to memory of 4792	2576	cmd.exe	108
PID 2576 wrote to memory of 392	2576	cmd.exe	109
PID 2576 wrote to memory of 392	2576	cmd.exe	109
PID 2576 wrote to memory of 392	2576	cmd.exe	109
PID 2576 wrote to memory of 3880	2576	cmd.exe	110
PID 2576 wrote to memory of 3880	2576	cmd.exe	110
PID 2576 wrote to memory of 3880	2576	cmd.exe	110
PID 2708 wrote to memory of 3356	2708	v1769708.exe	111
PID 2708 wrote to memory of 3356	2708	v1769708.exe	111
PID 2708 wrote to memory of 3356	2708	v1769708.exe	111

C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe
"C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:5028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        8⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        8⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        8⤵
        
        PID:392
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        8⤵
        
        PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3404
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe
    3⤵
    - Executes dropped EXE
    PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe

Filesize
514KB

MD5
7a2d3c4a82a09a3031f4ba34ace60c29

SHA1
a97778e12316ea6554509a2200499acac34cfbbb

SHA256
abde4ab5556453d1f8f112395377eaff87c54b72538ebde8bbeb4bc0b7a69643

SHA512
50e3fef3cb681e269699cf81d4fe965bf01eefee37bd8d7ec17a899cbd901402c7a1794428275d84b0f126f847990626e5bbab548b2927d13e37f283abe6126e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe

Filesize
173KB

MD5
028af37cd70bf53962253470737ee3af

SHA1
06e00855be95cb487667d40b10de22e5c12f91bd

SHA256
022b7a9e00824d70dd61582c52945dcc1361b7da607af6b9c96c33fe432dd951

SHA512
7dae9d88f2b7902fb9ecddbc5d3615baf26159a3778f3b1bae0824eb3e45880426e9c4650165c387ed752a7ce61a4c8e981303f0ea82874f63496ecbb59c406f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe

Filesize
359KB

MD5
f58247eeab098420f0857249f1e0de7f

SHA1
838acb6b4b150c188445b7633052f1f02f253f9d

SHA256
84524e515655961d6aadd8b4173620b3245cd58d564b626b301326593acc0845

SHA512
1413d573006ca4993d4ef208ebdd5c694579fccfe266347eead146bd14a0193229c6f37da80c65561a00555ab8cbcc63755fa923da68a5f219b8820d5d408eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe

Filesize
37KB

MD5
ef042fef96b5cb05413692409bdaf626

SHA1
62c2af43ebdf12cabaeadf5a248fd9a48dd776cd

SHA256
bff49c60ff35728524aa8e23017134eda8d3d07482d459f608e7ebe9131ec850

SHA512
4f89f0461bb7b505c2cc97ba428ce8e0342b4f76321ed5195974a46ea7880e682a8d36a751c1c970207edd9549ab8bef0eafe04a279d9ef7215559336d30e9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe

Filesize
234KB

MD5
b694261037fec3d2c30c15f1b3eda248

SHA1
1e3c35842413c2ec08f97e150956a18819d7acf1

SHA256
bdc64d77e90c043aaa78be6f2fad11aee100deb0001da671327d0ea5cda6e7fc

SHA512
8cdf12baf9cc54be2993f89fe8d0c3fa9aa097fdb212b12b074b6b13769aef67e7f5bc0591c316f81a7c89986f911ad86808d2bf2ea72460a1083a61d0bf7984

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe

Filesize
11KB

MD5
1cdbf941ccc9de4b1f14c24e1cfaff47

SHA1
f63e35492fa97f4b9728546932366314e79b624f

SHA256
28379a18f1fefd2841c051f8a3b6da73ef4d8bb2861d0f211ea83c21cad6a56e

SHA512
5078a541e90e2addda10dace672170769caf0b25190b4c11d82ae8c0f858d6c0b98e0017087a0d9e206777805c499bb903d858594754952602b9e2fa14e494c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe

Filesize
227KB

MD5
87864bdd796fa4ac12de1d9bef05a67d

SHA1
d789bdf46f33cf4d91cec44045deff80c3eac473

SHA256
578289200cb71983c1b6ce725ac7feed77c69671ac929c37b6af407dfbfc6b7a

SHA512
40c6053ce764d5e2cd7a83af290ba53f06822fb785f02cefd489d584f76ae0d0d167754415d1e403b3903895f80b030746af8ccb83c3f8457c5d79782e8f02e7

Download Submit
memory/1180-28-0x00000000008E0000-0x00000000008EA000-memory.dmp

Filesize
40KB

Download
memory/3240-47-0x0000000002B00000-0x0000000002B16000-memory.dmp

Filesize
88KB

Download
memory/3356-54-0x0000000000270000-0x00000000002A0000-memory.dmp

Filesize
192KB

Download
memory/3356-56-0x0000000002600000-0x0000000002606000-memory.dmp

Filesize
24KB

Download
memory/3356-57-0x000000000A6E0000-0x000000000ACF8000-memory.dmp

Filesize
6.1MB

Download
memory/3356-58-0x000000000A220000-0x000000000A32A000-memory.dmp

Filesize
1.0MB

Download
memory/3356-59-0x000000000A160000-0x000000000A172000-memory.dmp

Filesize
72KB

Download
memory/3356-60-0x000000000A1C0000-0x000000000A1FC000-memory.dmp

Filesize
240KB

Download
memory/3356-61-0x000000000A330000-0x000000000A37C000-memory.dmp

Filesize
304KB

Download
memory/3404-50-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3404-45-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download