Analysis
-
max time kernel
186s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
09-02-2022 10:21
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-en-20211208
General
-
Target
QUOTATION.exe
-
Size
564KB
-
MD5
98baccb2a35dcd64991688d8c2f9863e
-
SHA1
2cf34e18ccb91d2e0572ec833f8656178f4e834b
-
SHA256
33b08940d5a2fdd70c73fddf7e359193eb86a1d42e7cce27dba02718b7279c49
-
SHA512
caf53ba7e93e0f781877cfc318b429dbec9490b443ff8e5533f5ef0c89a1f612ac6e7cc245c99b34ffbf4c9bad95c8e2a183e7faffba3ce78a8b23b1c4757e54
Malware Config
Extracted
xloader
2.5
nt3f
tricyclee.com
kxsw999.com
wisteria-pavilion.com
bellaclancy.com
promissioskincare.com
hzy001.xyz
checkouthomehd.com
soladere.com
point4sales.com
socalmafia.com
libertadysarmiento.online
nftthirty.com
digitalgoldcryptostock.net
tulekiloscaird.com
austinfishandchicken.com
wlxxch.com
mgav51.xyz
landbanking.global
saprove.com
babyfaces.skin
elainemaxwellcoaching.com
1388xc.com
juveniscloud.com
bsauksjon.com
the-waterkooler.com
comment-changer-sa-vie.com
psmcnd.top
rhodesleadingedge.com
mccuelawfirm.com
skinnscience.club
hype-clicks.com
liaojinc.xyz
okmakers.com
ramblertour.online
wickedhunterworld.com
fit-threads.com
cookidoo.website
magentabin.com
pynch1.com
best-paper-to-know-today.info
allmight.net
monicraftsprintables.com
avataroasis.com
10dian-4.com
cozastore.net
capitalcased.com
spacezanome.xyz
feiyangmi.com
11opus.com
getinteriorsolution.com
tidyhutstore.com
amazingpomskyfamily.com
tfcvintage.com
halfanape.com
rotakb.com
martinasfood.com
the-thanks.com
mithilmehta.com
em-photo.art
primerepro.com
lankasirinspa.com
gtbaibang.com
zealandiatobacco.com
deepikatransportpackers.com
eagle-meter.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3944-143-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3944-149-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2116-159-0x0000000002AC0000-0x0000000002AE9000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
QUOTATION.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation QUOTATION.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTATION.exeQUOTATION.exemsiexec.exedescription pid process target process PID 3640 set thread context of 3944 3640 QUOTATION.exe QUOTATION.exe PID 3944 set thread context of 2420 3944 QUOTATION.exe Explorer.EXE PID 2116 set thread context of 2420 2116 msiexec.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 47 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.263197" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4084" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3936" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132890522529304998" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
QUOTATION.exepowershell.exemsiexec.exepid process 3944 QUOTATION.exe 3944 QUOTATION.exe 3944 QUOTATION.exe 3944 QUOTATION.exe 1940 powershell.exe 1940 powershell.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe 2116 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
QUOTATION.exemsiexec.exepid process 3944 QUOTATION.exe 3944 QUOTATION.exe 3944 QUOTATION.exe 2116 msiexec.exe 2116 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
QUOTATION.exeExplorer.EXEpowershell.exemsiexec.exedescription pid process Token: SeDebugPrivilege 3944 QUOTATION.exe Token: SeShutdownPrivilege 2420 Explorer.EXE Token: SeCreatePagefilePrivilege 2420 Explorer.EXE Token: SeShutdownPrivilege 2420 Explorer.EXE Token: SeCreatePagefilePrivilege 2420 Explorer.EXE Token: SeShutdownPrivilege 2420 Explorer.EXE Token: SeCreatePagefilePrivilege 2420 Explorer.EXE Token: SeDebugPrivilege 1940 powershell.exe Token: SeDebugPrivilege 2116 msiexec.exe Token: SeShutdownPrivilege 2420 Explorer.EXE Token: SeCreatePagefilePrivilege 2420 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
QUOTATION.exeExplorer.EXEdescription pid process target process PID 3640 wrote to memory of 1940 3640 QUOTATION.exe powershell.exe PID 3640 wrote to memory of 1940 3640 QUOTATION.exe powershell.exe PID 3640 wrote to memory of 1940 3640 QUOTATION.exe powershell.exe PID 3640 wrote to memory of 2988 3640 QUOTATION.exe schtasks.exe PID 3640 wrote to memory of 2988 3640 QUOTATION.exe schtasks.exe PID 3640 wrote to memory of 2988 3640 QUOTATION.exe schtasks.exe PID 3640 wrote to memory of 3944 3640 QUOTATION.exe QUOTATION.exe PID 3640 wrote to memory of 3944 3640 QUOTATION.exe QUOTATION.exe PID 3640 wrote to memory of 3944 3640 QUOTATION.exe QUOTATION.exe PID 3640 wrote to memory of 3944 3640 QUOTATION.exe QUOTATION.exe PID 3640 wrote to memory of 3944 3640 QUOTATION.exe QUOTATION.exe PID 3640 wrote to memory of 3944 3640 QUOTATION.exe QUOTATION.exe PID 2420 wrote to memory of 2116 2420 Explorer.EXE msiexec.exe PID 2420 wrote to memory of 2116 2420 Explorer.EXE msiexec.exe PID 2420 wrote to memory of 2116 2420 Explorer.EXE msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svUINqq.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\svUINqq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp12BC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp12BC.tmpMD5
8994ba6fa3d7e866d5095ef8d01985ba
SHA101444101a4fc1c7bb10b2f10242e7c197d3f1b81
SHA25637ceb9e4650e898b5d803f1e360aba35b2585bd9292652205f11fb708b9fd908
SHA51201d2213e65c20fb8eb454b30d48115cea6667b566366a92d8ed5afbd9a5caa21ff68319123df48cf08fa2daf564bfe042d9b0c618289e66b8cf62c27bb4a807c
-
memory/1940-153-0x0000000006B50000-0x0000000006B72000-memory.dmpFilesize
136KB
-
memory/1940-164-0x00000000080C0000-0x00000000080F2000-memory.dmpFilesize
200KB
-
memory/1940-175-0x0000000009130000-0x0000000009138000-memory.dmpFilesize
32KB
-
memory/1940-174-0x0000000009150000-0x000000000916A000-memory.dmpFilesize
104KB
-
memory/1940-173-0x0000000009040000-0x000000000904E000-memory.dmpFilesize
56KB
-
memory/1940-172-0x0000000009090000-0x0000000009126000-memory.dmpFilesize
600KB
-
memory/1940-152-0x0000000006CA0000-0x00000000072C8000-memory.dmpFilesize
6.2MB
-
memory/1940-140-0x000000007479E000-0x000000007479F000-memory.dmpFilesize
4KB
-
memory/1940-171-0x0000000008E80000-0x0000000008E8A000-memory.dmpFilesize
40KB
-
memory/1940-142-0x00000000065D0000-0x0000000006606000-memory.dmpFilesize
216KB
-
memory/1940-169-0x0000000009450000-0x0000000009ACA000-memory.dmpFilesize
6.5MB
-
memory/1940-145-0x0000000006660000-0x0000000006661000-memory.dmpFilesize
4KB
-
memory/1940-167-0x000000007EF20000-0x000000007EF21000-memory.dmpFilesize
4KB
-
memory/1940-166-0x00000000080A0000-0x00000000080BE000-memory.dmpFilesize
120KB
-
memory/1940-165-0x0000000070300000-0x000000007034C000-memory.dmpFilesize
304KB
-
memory/1940-162-0x0000000006665000-0x0000000006667000-memory.dmpFilesize
8KB
-
memory/1940-147-0x0000000006662000-0x0000000006663000-memory.dmpFilesize
4KB
-
memory/1940-154-0x0000000006BF0000-0x0000000006C56000-memory.dmpFilesize
408KB
-
memory/1940-160-0x0000000007AF0000-0x0000000007B0E000-memory.dmpFilesize
120KB
-
memory/1940-170-0x0000000008E10000-0x0000000008E2A000-memory.dmpFilesize
104KB
-
memory/1940-155-0x0000000007340000-0x00000000073A6000-memory.dmpFilesize
408KB
-
memory/2116-158-0x0000000000530000-0x0000000000542000-memory.dmpFilesize
72KB
-
memory/2116-159-0x0000000002AC0000-0x0000000002AE9000-memory.dmpFilesize
164KB
-
memory/2116-161-0x0000000004A60000-0x0000000004DAA000-memory.dmpFilesize
3.3MB
-
memory/2116-163-0x0000000004890000-0x0000000004920000-memory.dmpFilesize
576KB
-
memory/2420-148-0x0000000008A50000-0x0000000008B60000-memory.dmpFilesize
1.1MB
-
memory/2420-168-0x0000000008B60000-0x0000000008C9E000-memory.dmpFilesize
1.2MB
-
memory/3640-135-0x0000000000D20000-0x0000000000DBC000-memory.dmpFilesize
624KB
-
memory/3640-133-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/3640-137-0x0000000005C40000-0x00000000061E4000-memory.dmpFilesize
5.6MB
-
memory/3640-130-0x000000007479E000-0x000000007479F000-memory.dmpFilesize
4KB
-
memory/3640-131-0x0000000000580000-0x0000000000614000-memory.dmpFilesize
592KB
-
memory/3640-136-0x0000000005023000-0x0000000005025000-memory.dmpFilesize
8KB
-
memory/3640-134-0x00000000051D0000-0x0000000005262000-memory.dmpFilesize
584KB
-
memory/3640-132-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/3944-151-0x0000000001440000-0x0000000001451000-memory.dmpFilesize
68KB
-
memory/3944-150-0x00000000010F0000-0x000000000143A000-memory.dmpFilesize
3.3MB
-
memory/3944-146-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/3944-143-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3944-149-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB