Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2023 13:26
Static task
static1
Behavioral task
behavioral1
Sample
718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe
-
Size
517KB
-
MD5
4ab7f178296f4e4dc60cdaa2c6c57da3
-
SHA1
3c1ffc4be88c39ef5cb2bc1e0c3e04083cf1a83b
-
SHA256
718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159
-
SHA512
3810bc1ace8f239cffcecd9db2c0254d787230391e183167fc70acca62d4420a3a162f120f1f383cfa8eb7558fe1a5e3d51e36272af12c4b8c5c8d01e1bb630c
-
SSDEEP
6144:Kpy+bnr+/p0yN90QE0cQjMzxw9xAjiklSPmfgy48ZIpV5rnVb0cJj5XTvZoaqWxM:DMrvy90KcZw8j9bn4nV355tojeU5F
Malware Config
Extracted
amadey
3.86
5.42.92.67/norm/index.php
Extracted
redline
papik
77.91.124.156:19071
-
auth_value
325a615d8be5db8e2f7a4c2448fdac3a
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe healer C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe healer behavioral2/memory/1756-154-0x0000000000510000-0x000000000051A000-memory.dmp healer -
Processes:
p6253433.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p6253433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p6253433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p6253433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p6253433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p6253433.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p6253433.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
Processes:
z6719019.exez2931287.exep6253433.exer7420459.exelegola.exes5025783.exelegola.exelegola.exelegola.exepid process 3368 z6719019.exe 4792 z2931287.exe 1756 p6253433.exe 3920 r7420459.exe 4456 legola.exe 3364 s5025783.exe 3440 legola.exe 4948 legola.exe 2816 legola.exe -
Processes:
p6253433.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p6253433.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exez6719019.exez2931287.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6719019.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z2931287.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4952 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
p6253433.exepid process 1756 p6253433.exe 1756 p6253433.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p6253433.exedescription pid process Token: SeDebugPrivilege 1756 p6253433.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
r7420459.exepid process 3920 r7420459.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exez6719019.exez2931287.exer7420459.exelegola.execmd.exedescription pid process target process PID 2232 wrote to memory of 3368 2232 718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe z6719019.exe PID 2232 wrote to memory of 3368 2232 718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe z6719019.exe PID 2232 wrote to memory of 3368 2232 718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe z6719019.exe PID 3368 wrote to memory of 4792 3368 z6719019.exe z2931287.exe PID 3368 wrote to memory of 4792 3368 z6719019.exe z2931287.exe PID 3368 wrote to memory of 4792 3368 z6719019.exe z2931287.exe PID 4792 wrote to memory of 1756 4792 z2931287.exe p6253433.exe PID 4792 wrote to memory of 1756 4792 z2931287.exe p6253433.exe PID 4792 wrote to memory of 3920 4792 z2931287.exe r7420459.exe PID 4792 wrote to memory of 3920 4792 z2931287.exe r7420459.exe PID 4792 wrote to memory of 3920 4792 z2931287.exe r7420459.exe PID 3920 wrote to memory of 4456 3920 r7420459.exe legola.exe PID 3920 wrote to memory of 4456 3920 r7420459.exe legola.exe PID 3920 wrote to memory of 4456 3920 r7420459.exe legola.exe PID 3368 wrote to memory of 3364 3368 z6719019.exe s5025783.exe PID 3368 wrote to memory of 3364 3368 z6719019.exe s5025783.exe PID 3368 wrote to memory of 3364 3368 z6719019.exe s5025783.exe PID 4456 wrote to memory of 4868 4456 legola.exe schtasks.exe PID 4456 wrote to memory of 4868 4456 legola.exe schtasks.exe PID 4456 wrote to memory of 4868 4456 legola.exe schtasks.exe PID 4456 wrote to memory of 4936 4456 legola.exe cmd.exe PID 4456 wrote to memory of 4936 4456 legola.exe cmd.exe PID 4456 wrote to memory of 4936 4456 legola.exe cmd.exe PID 4936 wrote to memory of 4916 4936 cmd.exe cmd.exe PID 4936 wrote to memory of 4916 4936 cmd.exe cmd.exe PID 4936 wrote to memory of 4916 4936 cmd.exe cmd.exe PID 4936 wrote to memory of 4520 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 4520 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 4520 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3860 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3860 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3860 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3676 4936 cmd.exe cmd.exe PID 4936 wrote to memory of 3676 4936 cmd.exe cmd.exe PID 4936 wrote to memory of 3676 4936 cmd.exe cmd.exe PID 4936 wrote to memory of 3772 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3772 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3772 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3320 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3320 4936 cmd.exe cacls.exe PID 4936 wrote to memory of 3320 4936 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159exe_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exeFilesize
389KB
MD53172b68d5b2bb294b2fd14e1d59c44aa
SHA1ac2c7520d4261e79a1207157b28bdcbab485eba3
SHA256dd6b12f72f542c172e156771150d051f0e7fa9ac4defdd84cb7ff6e476e72a78
SHA512bdf0b0ff58829d8eae011b6ddafe6f41b5a02cef656a4b172c7746e71866319cb2f81b03782bf0064c7616599f7de80eedeaa847f3fd683c3aaf33640b31828f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6719019.exeFilesize
389KB
MD53172b68d5b2bb294b2fd14e1d59c44aa
SHA1ac2c7520d4261e79a1207157b28bdcbab485eba3
SHA256dd6b12f72f542c172e156771150d051f0e7fa9ac4defdd84cb7ff6e476e72a78
SHA512bdf0b0ff58829d8eae011b6ddafe6f41b5a02cef656a4b172c7746e71866319cb2f81b03782bf0064c7616599f7de80eedeaa847f3fd683c3aaf33640b31828f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exeFilesize
173KB
MD5fa4886b5da3cd7fefea2a49c7ca1d0ea
SHA12701da193294c92665e8d4e9a59cfb5487f979ce
SHA25651786be675bc0b5bc9eaef4bc8bc82d5d2ad89a9609442c06e3c3b918d52459d
SHA512f48e4ee4a6cc33458067453090b423aec4b13a110138e647918ab6d2938a094174aae2da0e0c3a10d720ae5afa16832f20793aba2b223e708897ab87d492031c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5025783.exeFilesize
173KB
MD5fa4886b5da3cd7fefea2a49c7ca1d0ea
SHA12701da193294c92665e8d4e9a59cfb5487f979ce
SHA25651786be675bc0b5bc9eaef4bc8bc82d5d2ad89a9609442c06e3c3b918d52459d
SHA512f48e4ee4a6cc33458067453090b423aec4b13a110138e647918ab6d2938a094174aae2da0e0c3a10d720ae5afa16832f20793aba2b223e708897ab87d492031c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exeFilesize
234KB
MD53e93fb5ac4bdf6d08ee89535300d44c6
SHA1544e47ddb6285698e534577a6be7ffb14827dd74
SHA2563b1fefdf2dc33007b68372954df0558d742762024f99e96040c2bbf0cd3d05b5
SHA512245a849ce2792a7a976cf75b90690c50dd7625156dc81190fbec7c1f27f12e7be70ef029c536e15146825b0a59495e7b21dbce79382b41a8d57cd6b26f9c613b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2931287.exeFilesize
234KB
MD53e93fb5ac4bdf6d08ee89535300d44c6
SHA1544e47ddb6285698e534577a6be7ffb14827dd74
SHA2563b1fefdf2dc33007b68372954df0558d742762024f99e96040c2bbf0cd3d05b5
SHA512245a849ce2792a7a976cf75b90690c50dd7625156dc81190fbec7c1f27f12e7be70ef029c536e15146825b0a59495e7b21dbce79382b41a8d57cd6b26f9c613b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exeFilesize
11KB
MD551e67270a039039a4c132037e36ad611
SHA13c454da773aa33952510c9c73e9ee562677bf7f7
SHA256738a535843cdf78cca4d3d1134f5ebcc25ef26f1b878aa83564fca383f7f48d9
SHA512e1b72101c3980b1abdf17c3c9431a5696f05aaf6603fe31c9b20bf4e6fa5bfd169817ed3e153dab076fe15305e1632d0a265e1d3e80943e211f40fc1f20c87ac
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6253433.exeFilesize
11KB
MD551e67270a039039a4c132037e36ad611
SHA13c454da773aa33952510c9c73e9ee562677bf7f7
SHA256738a535843cdf78cca4d3d1134f5ebcc25ef26f1b878aa83564fca383f7f48d9
SHA512e1b72101c3980b1abdf17c3c9431a5696f05aaf6603fe31c9b20bf4e6fa5bfd169817ed3e153dab076fe15305e1632d0a265e1d3e80943e211f40fc1f20c87ac
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7420459.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5572bc3b41caabb31ace07045cb818787
SHA1a8d07a2e54aee722e50a89043f69826804e41af1
SHA256c5eeee562b90333e1be9b17f0d13128cb12d275203899ef40e4870ca3f45e64a
SHA512a3ca98a9b29f0c8ffd1d1cb170bd171b80e366414d57321e52cc79be8e12f68a493e0760fa5d6a7985efa7e0afde6a1abb97e59b438659cdddd3af81cbd479bc
-
memory/1756-155-0x00007FFC015F0000-0x00007FFC020B1000-memory.dmpFilesize
10.8MB
-
memory/1756-157-0x00007FFC015F0000-0x00007FFC020B1000-memory.dmpFilesize
10.8MB
-
memory/1756-154-0x0000000000510000-0x000000000051A000-memory.dmpFilesize
40KB
-
memory/3364-175-0x0000000073B10000-0x00000000742C0000-memory.dmpFilesize
7.7MB
-
memory/3364-176-0x0000000005900000-0x0000000005F18000-memory.dmpFilesize
6.1MB
-
memory/3364-177-0x00000000053F0000-0x00000000054FA000-memory.dmpFilesize
1.0MB
-
memory/3364-179-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/3364-178-0x00000000052A0000-0x00000000052B2000-memory.dmpFilesize
72KB
-
memory/3364-180-0x0000000005320000-0x000000000535C000-memory.dmpFilesize
240KB
-
memory/3364-174-0x00000000007E0000-0x0000000000810000-memory.dmpFilesize
192KB
-
memory/3364-182-0x0000000073B10000-0x00000000742C0000-memory.dmpFilesize
7.7MB
-
memory/3364-183-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB