amadey | ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe
Size

315KB
MD5

c9cbf1f177667f0014030f672039324f
SHA1

6f3b56ec75cf87d16e1cdbfffb44e447019acb1a
SHA256

ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c
SHA512

c539d9dfe3803b280ef5d46458528e8a838faca02267fee1c975d9cdb30b16952f07ced3f842af796266b93d61534b6ef149adc47f70a0682e92beb96bf8f052
SSDEEP

6144:Ksy+bnr+0p0yN90QEodDN8qBJsofBI05FVFR6I/98WExAH3dIclptA+ZQ:oMroy90S3BW0I0h6IFAmXdBptU

Score

10^/10

amadey healer b50502 discovery dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.70

Botnet

b50502

http://77.91.124.207

Attributes

install_dir
595f021478
install_file
oneetx.exe
strings_key
6e3d32d239380a49b6f83128fe71ea01
url_paths
/plays/chapter/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023ba8-5.dat	healer
behavioral1/memory/1096-8-0x0000000000F80000-0x0000000000F8A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	az244752.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	az244752.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	az244752.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	az244752.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	az244752.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	az244752.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	bu269993.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 6 IoCs

pid	Process
1096	az244752.exe
1400	bu269993.exe
2736	oneetx.exe
4536	oneetx.exe
1228	oneetx.exe
2084	oneetx.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	az244752.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
1080	1400	WerFault.exe	85
2372	1400	WerFault.exe	85
1772	1400	WerFault.exe	85
1680	1400	WerFault.exe	85
1460	1400	WerFault.exe	85
3448	1400	WerFault.exe	85
2176	1400	WerFault.exe	85
3500	1400	WerFault.exe	85
2236	1400	WerFault.exe	85
980	1400	WerFault.exe	85
3116	2736	WerFault.exe	106
1564	1400	WerFault.exe	85
4956	2736	WerFault.exe	106
3272	2736	WerFault.exe	106
1600	2736	WerFault.exe	106
1100	2736	WerFault.exe	106
4416	2736	WerFault.exe	106
1880	2736	WerFault.exe	106
2004	2736	WerFault.exe	106
1948	2736	WerFault.exe	106
1656	2736	WerFault.exe	106
3808	2736	WerFault.exe	106
2192	2736	WerFault.exe	106
4280	4536	WerFault.exe	137
3040	2736	WerFault.exe	106
548	1228	WerFault.exe	144
5068	2084	WerFault.exe	147
5016	2736	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bu269993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	az244752.exe
1096	az244752.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	az244752.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1400	bu269993.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1096	632	ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe	83
PID 632 wrote to memory of 1096	632	ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe	83
PID 632 wrote to memory of 1400	632	ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe	85
PID 632 wrote to memory of 1400	632	ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe	85
PID 632 wrote to memory of 1400	632	ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe	85
PID 1400 wrote to memory of 2736	1400	bu269993.exe	106
PID 1400 wrote to memory of 2736	1400	bu269993.exe	106
PID 1400 wrote to memory of 2736	1400	bu269993.exe	106
PID 2736 wrote to memory of 952	2736	oneetx.exe	125
PID 2736 wrote to memory of 952	2736	oneetx.exe	125
PID 2736 wrote to memory of 952	2736	oneetx.exe	125

C:\Users\Admin\AppData\Local\Temp\ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe
"C:\Users\Admin\AppData\Local\Temp\ec172c18144bca523bf78f37080f2342f312c363f4f634906f73edab09f6265c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\az244752.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\az244752.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bu269993.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bu269993.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 696
    3⤵
    - Program crash
    PID:1080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 780
    3⤵
    - Program crash
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 856
    3⤵
    - Program crash
    PID:1772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 972
    3⤵
    - Program crash
    PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1008
    3⤵
    - Program crash
    PID:1460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1000
    3⤵
    - Program crash
    PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1216
    3⤵
    - Program crash
    PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1236
    3⤵
    - Program crash
    PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1316
    3⤵
    - Program crash
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 692
      4⤵
      Program crash
      PID:3116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1016
      4⤵
      Program crash
      PID:4956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1072
      4⤵
      Program crash
      PID:3272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1096
      4⤵
      Program crash
      PID:1600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 728
      4⤵
      Program crash
      PID:1100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1116
      4⤵
      Program crash
      PID:4416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1100
      4⤵
      Program crash
      PID:1880
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1004
      4⤵
      Program crash
      PID:2004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1296
      4⤵
      Program crash
      PID:1948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 720
      4⤵
      Program crash
      PID:1656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 784
      4⤵
      Program crash
      PID:3808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1420
      4⤵
      Program crash
      PID:2192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1136
      4⤵
      Program crash
      PID:3040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1388
      4⤵
      Program crash
      PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1720
    3⤵
    - Program crash
    PID:980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1740
    3⤵
    - Program crash
    PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1400 -ip 1400
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1400 -ip 1400
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1400 -ip 1400
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1400 -ip 1400
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1400 -ip 1400
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1400 -ip 1400
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1400 -ip 1400
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1400 -ip 1400
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1400 -ip 1400
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2736 -ip 2736
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1400 -ip 1400
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2736 -ip 2736
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2736 -ip 2736
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2736 -ip 2736
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2736 -ip 2736
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2736 -ip 2736
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2736 -ip 2736
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2736 -ip 2736
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2736 -ip 2736
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2736 -ip 2736
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2736 -ip 2736
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2736 -ip 2736
1⤵
PID:3692

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 216
  2⤵
  - Program crash
  PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4536 -ip 4536
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2736 -ip 2736
1⤵
PID:32

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 320
  2⤵
  - Program crash
  PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1228 -ip 1228
1⤵
PID:2732

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 216
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2084 -ip 2084
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2736 -ip 2736
1⤵
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\az244752.exe

Filesize
14KB

MD5
4db0d7e2dc0421230ca375d55cf1ba2e

SHA1
874ebf98e6d99df6be36499acd07c42058ebf6bb

SHA256
e228fa0375b00c7c6495d76cd64fd3fb235472a0eef3f668ef4d44d9bf98e407

SHA512
dfd5479bfcc25155a55bece60a90a17e8ad2cab8d045d4061ca7d99c1e3f762ab571246cb69c3fd7b5e1b6269405adc963dc54a79e7e83d79d55cef43acdff76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bu269993.exe

Filesize
234KB

MD5
eb198959c1a980a1d594f7d71838a9c6

SHA1
bab362d42a57ccdf9e86d914398ece711b87a51a

SHA256
d9c3d74379bd1c876079be6cac5eac2ce57c33d83341e96a976aa5c50e16dd2d

SHA512
b8cd8bf324fb4bc678e51104bdcc2658ce95392bee7ead766490922c867e45de484dcf8db84966f00353d0574f2320f284016311a2a0ca9f1ed4f9d3647b816c

Download Submit
memory/1096-7-0x00007FFC4F523000-0x00007FFC4F525000-memory.dmp

Filesize
8KB

Download
memory/1096-8-0x0000000000F80000-0x0000000000F8A000-memory.dmp

Filesize
40KB

Download
memory/1096-9-0x00007FFC4F523000-0x00007FFC4F525000-memory.dmp

Filesize
8KB

Download
memory/1228-47-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1400-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1400-17-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1400-16-0x00000000004B0000-0x00000000004EB000-memory.dmp

Filesize
236KB

Download
memory/1400-33-0x00000000004B0000-0x00000000004EB000-memory.dmp

Filesize
236KB

Download
memory/1400-32-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1400-15-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/2084-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2736-35-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2736-43-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2736-48-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4536-38-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download