Analysis
-
max time kernel
8s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2024 18:59
Behavioral task
behavioral1
Sample
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe
Resource
win10v2004-20240226-en
General
-
Target
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe
-
Size
2.0MB
-
MD5
1cc92b360b0430a3cdaca8ea25eceeef
-
SHA1
6810d293418468251950126879fb1c29b9446355
-
SHA256
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a
-
SHA512
d18fc370d2777b900acdfe881dbfc1d5febdfd09964f5dc252498b3aa8c5f3e5afe6d08b8dbe8095467a37a9201b527fa26be95d6697c2d71d7f657ef981eb96
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYV:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YH
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/2288-24-0x0000000000910000-0x000000000096E000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2288-24-0x0000000000910000-0x000000000096E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/memory/2288-24-0x0000000000910000-0x000000000096E000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_GENInfoStealer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe -
Executes dropped EXE 2 IoCs
Processes:
vnc.exewindef.exepid process 4260 vnc.exe 2288 windef.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exedescription ioc process File opened (read-only) \??\b: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\e: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\k: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\l: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\q: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\r: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\s: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\t: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\w: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\x: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\z: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\o: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\h: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\p: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\u: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\v: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\y: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\a: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\g: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\i: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\j: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\m: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe File opened (read-only) \??\n: 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 svchost.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vnc.exe32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exedescription pid process target process PID 4260 set thread context of 4900 4260 vnc.exe svchost.exe PID 3596 set thread context of 2900 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3924 696 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1480 schtasks.exe 2000 schtasks.exe 4288 schtasks.exe 872 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exepid process 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
vnc.exepid process 4260 vnc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exevnc.exedescription pid process target process PID 3596 wrote to memory of 4260 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe vnc.exe PID 3596 wrote to memory of 4260 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe vnc.exe PID 3596 wrote to memory of 4260 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe vnc.exe PID 3596 wrote to memory of 2288 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe windef.exe PID 3596 wrote to memory of 2288 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe windef.exe PID 3596 wrote to memory of 2288 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe windef.exe PID 4260 wrote to memory of 4900 4260 vnc.exe svchost.exe PID 4260 wrote to memory of 4900 4260 vnc.exe svchost.exe PID 4260 wrote to memory of 4900 4260 vnc.exe svchost.exe PID 3596 wrote to memory of 2900 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe PID 3596 wrote to memory of 2900 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe PID 3596 wrote to memory of 2900 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe PID 3596 wrote to memory of 2900 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe PID 4260 wrote to memory of 4900 4260 vnc.exe svchost.exe PID 3596 wrote to memory of 2900 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe PID 3596 wrote to memory of 1480 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe schtasks.exe PID 3596 wrote to memory of 1480 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe schtasks.exe PID 3596 wrote to memory of 1480 3596 32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe schtasks.exe PID 4260 wrote to memory of 4900 4260 vnc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe"C:\Users\Admin\AppData\Local\Temp\32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kwVVG46glzzP.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 22884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe"C:\Users\Admin\AppData\Local\Temp\32ef85fdccfd02a799bb8e2067eb358938d967fde1b8b02bc9e8498f090ac92a.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 696 -ip 6961⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\kwVVG46glzzP.batFilesize
208B
MD5b559449278fc9e83ab64ba6e9f26bbec
SHA1c6ca54cc739bb4526ccc2a336eb97ce9c910d9b7
SHA25656b803f284ae66d59b66c43d98636312ff771036c83395d0f469d488adaf304d
SHA512851e065de45becdeba7b6a8d48bacdb82f7dd9f4113dddf9d188480034e6f3b3fee52f9c45ffb947cf5de82a7da2c601e13b29a4d1a318a2aeb75b2e0fd4d4ab
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5101ead8b05aeb6546b27a8a59fb6ff97
SHA1da184384c8f493cc3d511e72ac09e655f56d648d
SHA2569715904a067af3ffc3e903ba1ecb9cb8b70701fbb550f232cd4c142099641de7
SHA512e11ad7faef7976a76a9b39884b0c7eda2eef9659896188e9bf02bff32ba9e1ea913141a2197ad9355dfa1cf34ef20b9316aff912d61c5eb4d08e9d73032d4ab5
-
memory/696-56-0x0000000006CD0000-0x0000000006CDA000-memory.dmpFilesize
40KB
-
memory/696-54-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/696-59-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/696-58-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/696-53-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/696-64-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/864-106-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/864-107-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/864-108-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/1340-95-0x0000000000150000-0x0000000000170000-memory.dmpFilesize
128KB
-
memory/1340-104-0x0000000000150000-0x0000000000170000-memory.dmpFilesize
128KB
-
memory/1380-88-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/1380-89-0x0000000000B40000-0x0000000000BDC000-memory.dmpFilesize
624KB
-
memory/1380-93-0x0000000000B40000-0x0000000000BDC000-memory.dmpFilesize
624KB
-
memory/1380-110-0x0000000000B40000-0x0000000000BDC000-memory.dmpFilesize
624KB
-
memory/2288-36-0x0000000005410000-0x00000000054A2000-memory.dmpFilesize
584KB
-
memory/2288-30-0x00000000059C0000-0x0000000005F64000-memory.dmpFilesize
5.6MB
-
memory/2288-52-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/2288-45-0x0000000006910000-0x000000000694C000-memory.dmpFilesize
240KB
-
memory/2288-44-0x0000000005990000-0x00000000059A2000-memory.dmpFilesize
72KB
-
memory/2288-43-0x0000000005520000-0x0000000005586000-memory.dmpFilesize
408KB
-
memory/2288-24-0x0000000000910000-0x000000000096E000-memory.dmpFilesize
376KB
-
memory/2288-21-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/2288-39-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/2508-86-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/2508-94-0x00000000057B0000-0x00000000057C0000-memory.dmpFilesize
64KB
-
memory/2508-109-0x00000000737D0000-0x0000000073F80000-memory.dmpFilesize
7.7MB
-
memory/2900-40-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2900-19-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3596-23-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/4900-38-0x00000000001C0000-0x000000000025C000-memory.dmpFilesize
624KB
-
memory/4900-27-0x00000000001C0000-0x000000000025C000-memory.dmpFilesize
624KB
-
memory/4900-28-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/4900-57-0x00000000001C0000-0x000000000025C000-memory.dmpFilesize
624KB