Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 20:32
Static task
static1
Behavioral task
behavioral1
Sample
CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe
Resource
win10v2004-20220721-en
General
-
Target
CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe
-
Size
996KB
-
MD5
e889cd39da3e9f962667476c76d6bae1
-
SHA1
4c5cb7af82e2898b881476b011bab031404ee48b
-
SHA256
92d256d51b6838c1a79f0b092c962c54587f6e8e0879676d9f8e225557c1ef9b
-
SHA512
f1862abad077d0fc19100ac664f7f90852303f5c76a570eb72e1c92daf8b6b0c6dbbcb7ac5a497bbe377cbee0be2f466a5e473de367ecedf423572c65942a05f
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 61 IoCs
Processes:
resource yara_rule behavioral2/memory/4948-145-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-161-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-162-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-163-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-164-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-165-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-166-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-167-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-168-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-169-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-170-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-171-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-172-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-173-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-174-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-175-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-176-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-177-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-178-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-179-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-180-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-181-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-182-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-183-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-184-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-185-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-186-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-187-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-188-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-189-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-190-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-191-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-192-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-193-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-194-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-195-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-197-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-196-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-198-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-200-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-199-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-201-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-202-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-203-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-204-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-208-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-209-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-210-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-211-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-212-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-213-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-214-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-215-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-216-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-217-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-218-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-219-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-220-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-221-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-222-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 behavioral2/memory/4948-223-0x00000000039D0000-0x0000000003A6D000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exeCNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zexxwx = "C:\\Users\\Public\\Libraries\\xwxxeZ.url" CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cmd.exenetsh.exedescription pid process target process PID 4064 set thread context of 2480 4064 cmd.exe Explorer.EXE PID 4752 set thread context of 2480 4752 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.execmd.exenetsh.exepid process 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe 4064 cmd.exe 4064 cmd.exe 4064 cmd.exe 4064 cmd.exe 4064 cmd.exe 4064 cmd.exe 4064 cmd.exe 4064 cmd.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2480 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
cmd.exenetsh.exepid process 4064 cmd.exe 4064 cmd.exe 4064 cmd.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe 4752 netsh.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cmd.exeExplorer.EXEnetsh.exedescription pid process Token: SeDebugPrivilege 4064 cmd.exe Token: SeShutdownPrivilege 2480 Explorer.EXE Token: SeCreatePagefilePrivilege 2480 Explorer.EXE Token: SeShutdownPrivilege 2480 Explorer.EXE Token: SeCreatePagefilePrivilege 2480 Explorer.EXE Token: SeDebugPrivilege 4752 netsh.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exeExplorer.EXEnetsh.exedescription pid process target process PID 4948 wrote to memory of 4064 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe cmd.exe PID 4948 wrote to memory of 4064 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe cmd.exe PID 4948 wrote to memory of 4064 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe cmd.exe PID 4948 wrote to memory of 4064 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe cmd.exe PID 4948 wrote to memory of 4064 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe cmd.exe PID 4948 wrote to memory of 4064 4948 CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe cmd.exe PID 2480 wrote to memory of 4752 2480 Explorer.EXE netsh.exe PID 2480 wrote to memory of 4752 2480 Explorer.EXE netsh.exe PID 2480 wrote to memory of 4752 2480 Explorer.EXE netsh.exe PID 4752 wrote to memory of 1592 4752 netsh.exe Firefox.exe PID 4752 wrote to memory of 1592 4752 netsh.exe Firefox.exe PID 4752 wrote to memory of 1592 4752 netsh.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe"C:\Users\Admin\AppData\Local\Temp\CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2480-255-0x0000000007BA0000-0x0000000007D1F000-memory.dmpFilesize
1.5MB
-
memory/2480-257-0x0000000007BA0000-0x0000000007D1F000-memory.dmpFilesize
1.5MB
-
memory/2480-238-0x00000000028A0000-0x0000000002A42000-memory.dmpFilesize
1.6MB
-
memory/4064-205-0x0000000000000000-mapping.dmp
-
memory/4064-234-0x00000000019B0000-0x0000000001CFA000-memory.dmpFilesize
3.3MB
-
memory/4064-236-0x0000000001920000-0x0000000001931000-memory.dmpFilesize
68KB
-
memory/4064-250-0x0000000050410000-0x000000005043D000-memory.dmpFilesize
180KB
-
memory/4752-256-0x0000000001100000-0x000000000112D000-memory.dmpFilesize
180KB
-
memory/4752-254-0x0000000001A90000-0x0000000001B20000-memory.dmpFilesize
576KB
-
memory/4752-253-0x0000000001100000-0x000000000112D000-memory.dmpFilesize
180KB
-
memory/4752-252-0x0000000001C60000-0x0000000001FAA000-memory.dmpFilesize
3.3MB
-
memory/4752-251-0x00000000011F0000-0x000000000120E000-memory.dmpFilesize
120KB
-
memory/4752-249-0x0000000000000000-mapping.dmp
-
memory/4948-191-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-200-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-170-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-171-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-172-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-173-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-174-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-175-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-176-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-177-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-178-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-179-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-180-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-181-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-182-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-183-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-184-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-185-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-186-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-187-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-188-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-189-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-190-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-168-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-192-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-193-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-194-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-195-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-197-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-196-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-198-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-169-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-199-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-201-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-202-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-203-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-204-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-207-0x0000000050410000-0x000000005043D000-memory.dmpFilesize
180KB
-
memory/4948-208-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-209-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-210-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-211-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-212-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-213-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-214-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-215-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-216-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-217-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-218-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-219-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-167-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-166-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-165-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-164-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-163-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-162-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-161-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-145-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-220-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-221-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-222-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB
-
memory/4948-223-0x00000000039D0000-0x0000000003A6D000-memory.dmpFilesize
628KB