Analysis
-
max time kernel
156s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
21-02-2022 23:08
Static task
static1
Behavioral task
behavioral1
Sample
Calendario dei pagamenti.exe
Resource
win7-en-20211208
General
-
Target
Calendario dei pagamenti.exe
-
Size
219KB
-
MD5
1a02db6595fb5471a1d91a4f51897269
-
SHA1
644069ab472309d4ecfca95de736dfb14676a776
-
SHA256
dd9c6267a87c89067d157e28d6f3ca17f958871f3d403609ed72dad80514e226
-
SHA512
ca86ca60343f96581c67ddaabd8553cfa030a1ae7cbedc0f05da403d972f7c2de9bf3048a0dbd43642c846f92f9c6f5b280f6537ef013a6d121fb70d72a2905d
Malware Config
Extracted
xloader
2.3
kio8
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
smallcoloradoweddings.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3936-132-0x00000000005C0000-0x00000000005E9000-memory.dmp xloader behavioral2/memory/3988-136-0x00000000001B0000-0x00000000001D9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Calendario dei pagamenti.exeCalendario dei pagamenti.exemstsc.exedescription pid process target process PID 3324 set thread context of 3936 3324 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 3936 set thread context of 2412 3936 Calendario dei pagamenti.exe Explorer.EXE PID 3988 set thread context of 2412 3988 mstsc.exe Explorer.EXE -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 51 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132901349372645325" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4120" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006604" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.493935" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "17.502100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.009135" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4324" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3952" svchost.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
Processes:
Calendario dei pagamenti.exemstsc.exepid process 3936 Calendario dei pagamenti.exe 3936 Calendario dei pagamenti.exe 3936 Calendario dei pagamenti.exe 3936 Calendario dei pagamenti.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe 3988 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Calendario dei pagamenti.exeCalendario dei pagamenti.exemstsc.exepid process 3324 Calendario dei pagamenti.exe 3324 Calendario dei pagamenti.exe 3936 Calendario dei pagamenti.exe 3936 Calendario dei pagamenti.exe 3936 Calendario dei pagamenti.exe 3988 mstsc.exe 3988 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Calendario dei pagamenti.exemstsc.exeTiWorker.exedescription pid process Token: SeDebugPrivilege 3936 Calendario dei pagamenti.exe Token: SeDebugPrivilege 3988 mstsc.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe Token: SeSecurityPrivilege 3768 TiWorker.exe Token: SeBackupPrivilege 3768 TiWorker.exe Token: SeRestorePrivilege 3768 TiWorker.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Calendario dei pagamenti.exeExplorer.EXEmstsc.exedescription pid process target process PID 3324 wrote to memory of 3936 3324 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 3324 wrote to memory of 3936 3324 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 3324 wrote to memory of 3936 3324 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 3324 wrote to memory of 3936 3324 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 2412 wrote to memory of 3988 2412 Explorer.EXE mstsc.exe PID 2412 wrote to memory of 3988 2412 Explorer.EXE mstsc.exe PID 2412 wrote to memory of 3988 2412 Explorer.EXE mstsc.exe PID 3988 wrote to memory of 1648 3988 mstsc.exe cmd.exe PID 3988 wrote to memory of 1648 3988 mstsc.exe cmd.exe PID 3988 wrote to memory of 1648 3988 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"3⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2412-134-0x00000000081F0000-0x00000000082A1000-memory.dmpFilesize
708KB
-
memory/2412-139-0x00000000088B0000-0x00000000089CD000-memory.dmpFilesize
1.1MB
-
memory/3324-130-0x00000000010FD000-0x0000000001100000-memory.dmpFilesize
12KB
-
memory/3936-131-0x0000000000D90000-0x00000000010DA000-memory.dmpFilesize
3.3MB
-
memory/3936-132-0x00000000005C0000-0x00000000005E9000-memory.dmpFilesize
164KB
-
memory/3936-133-0x00000000005F0000-0x0000000000600000-memory.dmpFilesize
64KB
-
memory/3988-135-0x00000000004E0000-0x000000000061A000-memory.dmpFilesize
1.2MB
-
memory/3988-136-0x00000000001B0000-0x00000000001D9000-memory.dmpFilesize
164KB
-
memory/3988-137-0x0000000004580000-0x00000000048CA000-memory.dmpFilesize
3.3MB
-
memory/3988-138-0x00000000042B0000-0x000000000433F000-memory.dmpFilesize
572KB