Analysis
-
max time kernel
186s -
max time network
230s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 23:58
Static task
static1
Behavioral task
behavioral1
Sample
1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe
Resource
win10v2004-20230220-en
General
-
Target
1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe
-
Size
1.5MB
-
MD5
a7d7366a2e0f9ebc538f199cea5194d1
-
SHA1
68410f20f1ad75c6138251db1dc35aed80f16fc8
-
SHA256
1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671
-
SHA512
7a57cbb40450f205b011a9b5d76ff4f4d40e214862f39bb86e424365647deef88072ee86c2c5725fa414d33556f01db001be217422b4229fedf19093e7657849
-
SSDEEP
24576:uyi2gZqXdupLpzGG3ilIdy5COEoiytdatcZvJ8tlkmp9u51LJ/MJlrqmwuL5SDxz:9ifHp1GblIY5Goptotsxo3uDhMJIuUQ
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
55623347.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 55623347.exe -
Executes dropped EXE 7 IoCs
Processes:
za902344.exeza671433.exeza580242.exe55623347.exe1.exeu96640760.exew27py31.exepid process 4732 za902344.exe 1988 za671433.exe 2976 za580242.exe 3828 55623347.exe 4864 1.exe 1128 u96640760.exe 2844 w27py31.exe -
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
za671433.exeza580242.exe1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exeza902344.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za671433.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za671433.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za580242.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" za580242.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za902344.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za902344.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2336 1128 WerFault.exe u96640760.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1.exepid process 4864 1.exe 4864 1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
55623347.exeu96640760.exe1.exedescription pid process Token: SeDebugPrivilege 3828 55623347.exe Token: SeDebugPrivilege 1128 u96640760.exe Token: SeDebugPrivilege 4864 1.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exeza902344.exeza671433.exeza580242.exe55623347.exedescription pid process target process PID 2776 wrote to memory of 4732 2776 1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe za902344.exe PID 2776 wrote to memory of 4732 2776 1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe za902344.exe PID 2776 wrote to memory of 4732 2776 1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe za902344.exe PID 4732 wrote to memory of 1988 4732 za902344.exe za671433.exe PID 4732 wrote to memory of 1988 4732 za902344.exe za671433.exe PID 4732 wrote to memory of 1988 4732 za902344.exe za671433.exe PID 1988 wrote to memory of 2976 1988 za671433.exe za580242.exe PID 1988 wrote to memory of 2976 1988 za671433.exe za580242.exe PID 1988 wrote to memory of 2976 1988 za671433.exe za580242.exe PID 2976 wrote to memory of 3828 2976 za580242.exe 55623347.exe PID 2976 wrote to memory of 3828 2976 za580242.exe 55623347.exe PID 2976 wrote to memory of 3828 2976 za580242.exe 55623347.exe PID 3828 wrote to memory of 4864 3828 55623347.exe 1.exe PID 3828 wrote to memory of 4864 3828 55623347.exe 1.exe PID 2976 wrote to memory of 1128 2976 za580242.exe u96640760.exe PID 2976 wrote to memory of 1128 2976 za580242.exe u96640760.exe PID 2976 wrote to memory of 1128 2976 za580242.exe u96640760.exe PID 1988 wrote to memory of 2844 1988 za671433.exe w27py31.exe PID 1988 wrote to memory of 2844 1988 za671433.exe w27py31.exe PID 1988 wrote to memory of 2844 1988 za671433.exe w27py31.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe"C:\Users\Admin\AppData\Local\Temp\1fc40effc0d9bc808c392e1e1264c005f2ee217dc3d850f8bb1339bac4dad671.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za902344.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za902344.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za671433.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za671433.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za580242.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za580242.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55623347.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55623347.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96640760.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96640760.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 12646⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w27py31.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w27py31.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1128 -ip 11281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za902344.exeFilesize
1.3MB
MD57cd53d68fd51a102d76eb2ac1db8b044
SHA17aa626fd8933b46845b1cd5e29a8c25108206105
SHA256751ce7b2738ac523127fd69229e77472a264e150a560b8356ac2e743766b0cfc
SHA5122794be87d516328645f476c82231fd8cf8faf04175e39169c50551bf3538c0e45d472a383f720f3be60712a1385daf7a7e4c6adad2709da59bd95b81b698fce9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za902344.exeFilesize
1.3MB
MD57cd53d68fd51a102d76eb2ac1db8b044
SHA17aa626fd8933b46845b1cd5e29a8c25108206105
SHA256751ce7b2738ac523127fd69229e77472a264e150a560b8356ac2e743766b0cfc
SHA5122794be87d516328645f476c82231fd8cf8faf04175e39169c50551bf3538c0e45d472a383f720f3be60712a1385daf7a7e4c6adad2709da59bd95b81b698fce9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za671433.exeFilesize
863KB
MD517c0189904de6aa6b0ae37844139dcdc
SHA1f1cddfc236591a39dd16201839a37fdb7428ba21
SHA25618a57b43e6314eac79f49ef7fee0315fd2e654760a0f6c2ddf45a040ec1265fa
SHA5129a49a043ea0ddc44a9c8493df45c2ad446584c353a9b81519032a6aef021aa5713ce00ef932f3fce6c0491d033f0a63458ab2a6ecc725f368e4a3300ab814bfd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za671433.exeFilesize
863KB
MD517c0189904de6aa6b0ae37844139dcdc
SHA1f1cddfc236591a39dd16201839a37fdb7428ba21
SHA25618a57b43e6314eac79f49ef7fee0315fd2e654760a0f6c2ddf45a040ec1265fa
SHA5129a49a043ea0ddc44a9c8493df45c2ad446584c353a9b81519032a6aef021aa5713ce00ef932f3fce6c0491d033f0a63458ab2a6ecc725f368e4a3300ab814bfd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w27py31.exeFilesize
229KB
MD52259eeb8d39e7914d26285d244ac6638
SHA150d267350a660237a0db6ec6c1952a417334b567
SHA25619e707464d3a716b35c4208c19b665c5081d4a78e4be062a9174d2117f8afe57
SHA512d1831b609405313f2315774311b750ff4dfb6ae106e187b1379aa06e079b9bd11fe96fa258b78980cd4a53e0caaf98f87cb236c1c4ab76197b40a0e14fef033e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w27py31.exeFilesize
229KB
MD52259eeb8d39e7914d26285d244ac6638
SHA150d267350a660237a0db6ec6c1952a417334b567
SHA25619e707464d3a716b35c4208c19b665c5081d4a78e4be062a9174d2117f8afe57
SHA512d1831b609405313f2315774311b750ff4dfb6ae106e187b1379aa06e079b9bd11fe96fa258b78980cd4a53e0caaf98f87cb236c1c4ab76197b40a0e14fef033e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za580242.exeFilesize
680KB
MD5a548aafdd0c6a2ec1d9f81d0148a00fe
SHA17fb3b5c5ccfea62d37d4418f7d7ba641a0d3603b
SHA256f20e3f3c9e6ea2e41aa417da6203684b6f0c0b07e15c4299bb7f5c71c0bbaf39
SHA512b70f9512548028f02cdcaff43c9e801beaa447b836f974e986d2ecb5ca4063e2d395b271b7b4bc39c8453f7fac9e55e67ad44471a1f97f06d2d4e7a5e04c870d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za580242.exeFilesize
680KB
MD5a548aafdd0c6a2ec1d9f81d0148a00fe
SHA17fb3b5c5ccfea62d37d4418f7d7ba641a0d3603b
SHA256f20e3f3c9e6ea2e41aa417da6203684b6f0c0b07e15c4299bb7f5c71c0bbaf39
SHA512b70f9512548028f02cdcaff43c9e801beaa447b836f974e986d2ecb5ca4063e2d395b271b7b4bc39c8453f7fac9e55e67ad44471a1f97f06d2d4e7a5e04c870d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55623347.exeFilesize
301KB
MD54167de39091da235a643a06d0f505e78
SHA1fc8488c29ac50aa55781faece4bdebce6bd675d2
SHA256299ce0bd498f51600597145feae9af85811cd733158a5de82c6f57bdc52821b1
SHA512136b2652b38d05db8ada03074821cd4697aaf41a189df76cc1ab9f5f72a49c16cc55957fe6479b6b2d96d8a4cb4c266540c39c9031e177c06a63ebefddfa1134
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55623347.exeFilesize
301KB
MD54167de39091da235a643a06d0f505e78
SHA1fc8488c29ac50aa55781faece4bdebce6bd675d2
SHA256299ce0bd498f51600597145feae9af85811cd733158a5de82c6f57bdc52821b1
SHA512136b2652b38d05db8ada03074821cd4697aaf41a189df76cc1ab9f5f72a49c16cc55957fe6479b6b2d96d8a4cb4c266540c39c9031e177c06a63ebefddfa1134
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96640760.exeFilesize
522KB
MD59937b20cb7580c1a17d76c5f1f038783
SHA15d561314f149f3bab744f9bf4ce6bd4b2a93c732
SHA2567c68ffcfcb36d2a48a3a1e60e615d94ee35bc0e2967e206032afa9129bc1c88c
SHA5124b7128fa8973a3b2c3140416c8df5e0b7a52a78ab9bc3a3582420803638c421e79a9af2ec6a6384571e38831174024d20fbb3c74bc6691695c9bb8d51b4c37ce
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96640760.exeFilesize
522KB
MD59937b20cb7580c1a17d76c5f1f038783
SHA15d561314f149f3bab744f9bf4ce6bd4b2a93c732
SHA2567c68ffcfcb36d2a48a3a1e60e615d94ee35bc0e2967e206032afa9129bc1c88c
SHA5124b7128fa8973a3b2c3140416c8df5e0b7a52a78ab9bc3a3582420803638c421e79a9af2ec6a6384571e38831174024d20fbb3c74bc6691695c9bb8d51b4c37ce
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
memory/1128-4447-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/1128-4443-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/1128-2315-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/1128-2313-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/1128-2310-0x0000000000830000-0x000000000087C000-memory.dmpFilesize
304KB
-
memory/1128-2311-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/1128-4444-0x0000000005710000-0x00000000057A2000-memory.dmpFilesize
584KB
-
memory/1128-4446-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/1128-4448-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/1128-4449-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/3828-171-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-2293-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3828-195-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-197-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-199-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-201-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-203-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-205-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-207-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-209-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-211-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-213-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-215-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-217-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-219-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-221-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-223-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-225-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-227-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-193-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-191-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-189-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-187-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-185-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-183-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-161-0x0000000004BD0000-0x0000000005174000-memory.dmpFilesize
5.6MB
-
memory/3828-181-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-179-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-177-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-175-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-173-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-169-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-164-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-165-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-167-0x0000000004A20000-0x0000000004A71000-memory.dmpFilesize
324KB
-
memory/3828-163-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3828-162-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/4864-2308-0x0000000000D90000-0x0000000000D9A000-memory.dmpFilesize
40KB