Analysis

  • max time kernel
    206s
  • max time network
    208s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 03:05

General

  • Target

    6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe

  • Size

    1.3MB

  • MD5

    b2a5d3059feddcf5aa6bc72019a0ecbf

  • SHA1

    e881e8238947dd3fba6f5f96626fcf113d5bb783

  • SHA256

    6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86

  • SHA512

    585dd3d7da710cdb600d0c5116c07fd71f52a306f65976072dcfdf4a5dc6ec0b76556bbc65ef696355ffd64dcd6dad854ad28f24328847e44905d4aef6fd77ca

  • SSDEEP

    24576:pyFE94xiOVOFwp9Y9DLgLx5LCtiZsbuHRWzGgTN3bDTH9fSWQJjIaqAIQX3214se:cFuQ3VBIDLyutoYiUrBglSV

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe
    "C:\Users\Admin\AppData\Local\Temp\6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3160
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5044
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4496
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u62429171.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u62429171.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3712
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 1048
              6⤵
              • Program crash
              PID:3016
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w77Ws02.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w77Ws02.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4196
          • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:2936
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwREP15.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwREP15.exe
        3⤵
        • Executes dropped EXE
        PID:2504
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3712 -ip 3712
    1⤵
      PID:1684

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      Filesize

      230KB

      MD5

      56b993d8490a3206c31b494cf0e55fca

      SHA1

      358a90b1f7776fff882f047272a04cbe8fb978e8

      SHA256

      6b30b685d2907ca2ba02e2195ea045b0e044e5d0132cd65f1a1da37f848994b3

      SHA512

      62b9aecb75636b6235ae0bd7ae1d9334a84ac834355e17d4fcb74bf7fcbef5a01386e81c98ea311959516187c204b420b5a5acec0fcde17cc30dc1de433ccb80

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      Filesize

      230KB

      MD5

      56b993d8490a3206c31b494cf0e55fca

      SHA1

      358a90b1f7776fff882f047272a04cbe8fb978e8

      SHA256

      6b30b685d2907ca2ba02e2195ea045b0e044e5d0132cd65f1a1da37f848994b3

      SHA512

      62b9aecb75636b6235ae0bd7ae1d9334a84ac834355e17d4fcb74bf7fcbef5a01386e81c98ea311959516187c204b420b5a5acec0fcde17cc30dc1de433ccb80

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      Filesize

      230KB

      MD5

      56b993d8490a3206c31b494cf0e55fca

      SHA1

      358a90b1f7776fff882f047272a04cbe8fb978e8

      SHA256

      6b30b685d2907ca2ba02e2195ea045b0e044e5d0132cd65f1a1da37f848994b3

      SHA512

      62b9aecb75636b6235ae0bd7ae1d9334a84ac834355e17d4fcb74bf7fcbef5a01386e81c98ea311959516187c204b420b5a5acec0fcde17cc30dc1de433ccb80

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exe
      Filesize

      1.2MB

      MD5

      b3ef537c9bb941d6f6a568706fc7be9d

      SHA1

      b76060e52787dd05dca149bdad6f004e0a8ab8c9

      SHA256

      e07c65a9bed54c40c6ffcb860901ba35035d0b00cfd50fdff465d866d5f6c624

      SHA512

      7cdcd4985d482a8ecf208ab532ae2057941d8c5d373ab3ea79384590e99efe80b9d5af868ab2ffcc04f45d15593d91df2e6a9633d81f9ab1d6cd46619a60f1f0

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exe
      Filesize

      1.2MB

      MD5

      b3ef537c9bb941d6f6a568706fc7be9d

      SHA1

      b76060e52787dd05dca149bdad6f004e0a8ab8c9

      SHA256

      e07c65a9bed54c40c6ffcb860901ba35035d0b00cfd50fdff465d866d5f6c624

      SHA512

      7cdcd4985d482a8ecf208ab532ae2057941d8c5d373ab3ea79384590e99efe80b9d5af868ab2ffcc04f45d15593d91df2e6a9633d81f9ab1d6cd46619a60f1f0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwREP15.exe
      Filesize

      576KB

      MD5

      2f8d4a6b6c4efd964540df732d216d7c

      SHA1

      f4b88ec96567ce558ba1e8c9eb16b5718374dfbf

      SHA256

      8d4a77bef65643bf23e03ec5de9941499b5658e7e74e2b6fdd7ae78af526a9b3

      SHA512

      f3e9a9f28b3953b5a9e5b8c33b9eec72a50a40ab16616b236d3267458e40dfff5c0c66bdf69d4e6c6db529974a18ec814743b4e5f1679884fba37cdc0b1c50d6

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwREP15.exe
      Filesize

      576KB

      MD5

      2f8d4a6b6c4efd964540df732d216d7c

      SHA1

      f4b88ec96567ce558ba1e8c9eb16b5718374dfbf

      SHA256

      8d4a77bef65643bf23e03ec5de9941499b5658e7e74e2b6fdd7ae78af526a9b3

      SHA512

      f3e9a9f28b3953b5a9e5b8c33b9eec72a50a40ab16616b236d3267458e40dfff5c0c66bdf69d4e6c6db529974a18ec814743b4e5f1679884fba37cdc0b1c50d6

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exe
      Filesize

      738KB

      MD5

      36f11a86bdf2a1575761005939aa1a87

      SHA1

      57a77fec4b189beaab4361dfb339ec3b99e2a19c

      SHA256

      506b92485a70ce1083236c0006004dde0159c0f30e9caac92b640ea32ec3a118

      SHA512

      e4ca70220aa6e987b2050490122de0a31d4d9a731f596ce1feab339b42a7a63e6d0a7611b850401fcc5b4b89277b96b0495e97c711e7335c3d21145c64508b80

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exe
      Filesize

      738KB

      MD5

      36f11a86bdf2a1575761005939aa1a87

      SHA1

      57a77fec4b189beaab4361dfb339ec3b99e2a19c

      SHA256

      506b92485a70ce1083236c0006004dde0159c0f30e9caac92b640ea32ec3a118

      SHA512

      e4ca70220aa6e987b2050490122de0a31d4d9a731f596ce1feab339b42a7a63e6d0a7611b850401fcc5b4b89277b96b0495e97c711e7335c3d21145c64508b80

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w77Ws02.exe
      Filesize

      230KB

      MD5

      56b993d8490a3206c31b494cf0e55fca

      SHA1

      358a90b1f7776fff882f047272a04cbe8fb978e8

      SHA256

      6b30b685d2907ca2ba02e2195ea045b0e044e5d0132cd65f1a1da37f848994b3

      SHA512

      62b9aecb75636b6235ae0bd7ae1d9334a84ac834355e17d4fcb74bf7fcbef5a01386e81c98ea311959516187c204b420b5a5acec0fcde17cc30dc1de433ccb80

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w77Ws02.exe
      Filesize

      230KB

      MD5

      56b993d8490a3206c31b494cf0e55fca

      SHA1

      358a90b1f7776fff882f047272a04cbe8fb978e8

      SHA256

      6b30b685d2907ca2ba02e2195ea045b0e044e5d0132cd65f1a1da37f848994b3

      SHA512

      62b9aecb75636b6235ae0bd7ae1d9334a84ac834355e17d4fcb74bf7fcbef5a01386e81c98ea311959516187c204b420b5a5acec0fcde17cc30dc1de433ccb80

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exe
      Filesize

      555KB

      MD5

      a60498e286698e03bc8c23d3bf184b2e

      SHA1

      aa40de169c13039c3bb75dc7f00ddd05bff23efb

      SHA256

      99adff2346ec29d751c0c75f897bf53231e15f02e6f409d65a3fceb6c513accb

      SHA512

      2f3994b5f73fdb571c192e620a0e8addab6a88967d30366b92000a0239069676b9575005950442cb1e07108bc00b4e3193c6c7a6e0471d807c708e8d8d98ca57

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exe
      Filesize

      555KB

      MD5

      a60498e286698e03bc8c23d3bf184b2e

      SHA1

      aa40de169c13039c3bb75dc7f00ddd05bff23efb

      SHA256

      99adff2346ec29d751c0c75f897bf53231e15f02e6f409d65a3fceb6c513accb

      SHA512

      2f3994b5f73fdb571c192e620a0e8addab6a88967d30366b92000a0239069676b9575005950442cb1e07108bc00b4e3193c6c7a6e0471d807c708e8d8d98ca57

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exe
      Filesize

      303KB

      MD5

      72e992838821425176065199ae3a092c

      SHA1

      369077f94ab629ff7412c84302aa975e227b3b96

      SHA256

      625ce2ba9ff4d599975c5643b72b3a24e6194a65fca7d876d9c71fdaa13692b5

      SHA512

      ec96555550e975796e84128d3f3ffd93bdf557513baaab90607be30712d6939a755d73a9e341a93f3204c455a522fb085709e0fb8e85d19819a6be172d3e6713

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exe
      Filesize

      303KB

      MD5

      72e992838821425176065199ae3a092c

      SHA1

      369077f94ab629ff7412c84302aa975e227b3b96

      SHA256

      625ce2ba9ff4d599975c5643b72b3a24e6194a65fca7d876d9c71fdaa13692b5

      SHA512

      ec96555550e975796e84128d3f3ffd93bdf557513baaab90607be30712d6939a755d73a9e341a93f3204c455a522fb085709e0fb8e85d19819a6be172d3e6713

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u62429171.exe
      Filesize

      393KB

      MD5

      0f930cda85f40b92b4164b6897383545

      SHA1

      3df651b914c690fad89ab216bf968abd44db8ef1

      SHA256

      dddc5d89366297b841b57c4f6f345223b060fcc1f5ac3af1c4bef6d7a9fb9a51

      SHA512

      0f044542892cb015b4ba60a74244633faaf48799be62904147c23a6a07b23741b134d52cdb3d5eb0bb76ee7dc4c3c54c1d2b8fd79a550a8f06885464a9c5730e

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u62429171.exe
      Filesize

      393KB

      MD5

      0f930cda85f40b92b4164b6897383545

      SHA1

      3df651b914c690fad89ab216bf968abd44db8ef1

      SHA256

      dddc5d89366297b841b57c4f6f345223b060fcc1f5ac3af1c4bef6d7a9fb9a51

      SHA512

      0f044542892cb015b4ba60a74244633faaf48799be62904147c23a6a07b23741b134d52cdb3d5eb0bb76ee7dc4c3c54c1d2b8fd79a550a8f06885464a9c5730e

    • C:\Windows\Temp\1.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Windows\Temp\1.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Windows\Temp\1.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • memory/3712-2347-0x0000000002820000-0x0000000002830000-memory.dmp
      Filesize

      64KB

    • memory/3712-2343-0x0000000002820000-0x0000000002830000-memory.dmp
      Filesize

      64KB

    • memory/3712-2342-0x0000000000810000-0x000000000083D000-memory.dmp
      Filesize

      180KB

    • memory/3712-2344-0x0000000002820000-0x0000000002830000-memory.dmp
      Filesize

      64KB

    • memory/3712-2345-0x0000000002820000-0x0000000002830000-memory.dmp
      Filesize

      64KB

    • memory/3712-2349-0x0000000002820000-0x0000000002830000-memory.dmp
      Filesize

      64KB

    • memory/3712-2348-0x0000000002820000-0x0000000002830000-memory.dmp
      Filesize

      64KB

    • memory/4496-2312-0x0000000000580000-0x000000000058A000-memory.dmp
      Filesize

      40KB

    • memory/5044-174-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-196-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-200-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-202-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-204-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-206-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-208-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-210-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-212-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-214-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-216-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-218-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-220-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-222-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-224-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-226-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-228-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-2293-0x0000000004A80000-0x0000000004A90000-memory.dmp
      Filesize

      64KB

    • memory/5044-2294-0x0000000004A80000-0x0000000004A90000-memory.dmp
      Filesize

      64KB

    • memory/5044-2295-0x0000000004A80000-0x0000000004A90000-memory.dmp
      Filesize

      64KB

    • memory/5044-2297-0x0000000004A80000-0x0000000004A90000-memory.dmp
      Filesize

      64KB

    • memory/5044-198-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-194-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-192-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-190-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-186-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-188-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-184-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-182-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-180-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-178-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-176-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-172-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-170-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-168-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-166-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-165-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/5044-164-0x0000000004AB0000-0x0000000005054000-memory.dmp
      Filesize

      5.6MB

    • memory/5044-163-0x0000000004A80000-0x0000000004A90000-memory.dmp
      Filesize

      64KB

    • memory/5044-162-0x0000000004A80000-0x0000000004A90000-memory.dmp
      Filesize

      64KB

    • memory/5044-161-0x0000000004A80000-0x0000000004A90000-memory.dmp
      Filesize

      64KB