Analysis
-
max time kernel
59s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 03:34
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER .exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
NEW ORDER .exe
Resource
win10v2004-20220414-en
General
-
Target
NEW ORDER .exe
-
Size
709KB
-
MD5
e6f2ef791f0ec1869a975fa14248e8a1
-
SHA1
bca1cf7d10b095100273065d9e59fd1107afd353
-
SHA256
c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
-
SHA512
247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt
masslogger
Extracted
C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 2 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt masslogger_log_file -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1980-57-0x0000000005170000-0x000000000521E000-memory.dmp rezer0 -
Executes dropped EXE 6 IoCs
Processes:
vlc.exevlc.exevlc.exevlc.exevlc.exevlc.exepid process 1616 vlc.exe 1608 vlc.exe 1992 vlc.exe 1536 vlc.exe 1568 vlc.exe 1524 vlc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEW ORDER .exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation NEW ORDER .exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 800 cmd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
NEW ORDER .exevlc.exedescription pid process target process PID 1980 set thread context of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1616 set thread context of 1524 1616 vlc.exe vlc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1120 schtasks.exe 1668 schtasks.exe 1504 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1028 timeout.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
NEW ORDER .exeNEW ORDER .exevlc.exepid process 1980 NEW ORDER .exe 1980 NEW ORDER .exe 1732 NEW ORDER .exe 1616 vlc.exe 1616 vlc.exe 1616 vlc.exe 1616 vlc.exe 1616 vlc.exe 1616 vlc.exe 1616 vlc.exe 1616 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
NEW ORDER .exeNEW ORDER .exevlc.exevlc.exedescription pid process Token: SeDebugPrivilege 1980 NEW ORDER .exe Token: SeDebugPrivilege 1732 NEW ORDER .exe Token: SeDebugPrivilege 1616 vlc.exe Token: SeDebugPrivilege 1524 vlc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
NEW ORDER .exeNEW ORDER .execmd.execmd.exevlc.exedescription pid process target process PID 1980 wrote to memory of 1120 1980 NEW ORDER .exe schtasks.exe PID 1980 wrote to memory of 1120 1980 NEW ORDER .exe schtasks.exe PID 1980 wrote to memory of 1120 1980 NEW ORDER .exe schtasks.exe PID 1980 wrote to memory of 1120 1980 NEW ORDER .exe schtasks.exe PID 1980 wrote to memory of 1748 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1748 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1748 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1748 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1484 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1484 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1484 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1484 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1980 wrote to memory of 1732 1980 NEW ORDER .exe NEW ORDER .exe PID 1732 wrote to memory of 1628 1732 NEW ORDER .exe cmd.exe PID 1732 wrote to memory of 1628 1732 NEW ORDER .exe cmd.exe PID 1732 wrote to memory of 1628 1732 NEW ORDER .exe cmd.exe PID 1732 wrote to memory of 1628 1732 NEW ORDER .exe cmd.exe PID 1732 wrote to memory of 800 1732 NEW ORDER .exe cmd.exe PID 1732 wrote to memory of 800 1732 NEW ORDER .exe cmd.exe PID 1732 wrote to memory of 800 1732 NEW ORDER .exe cmd.exe PID 1732 wrote to memory of 800 1732 NEW ORDER .exe cmd.exe PID 1628 wrote to memory of 1668 1628 cmd.exe schtasks.exe PID 1628 wrote to memory of 1668 1628 cmd.exe schtasks.exe PID 1628 wrote to memory of 1668 1628 cmd.exe schtasks.exe PID 1628 wrote to memory of 1668 1628 cmd.exe schtasks.exe PID 800 wrote to memory of 1028 800 cmd.exe timeout.exe PID 800 wrote to memory of 1028 800 cmd.exe timeout.exe PID 800 wrote to memory of 1028 800 cmd.exe timeout.exe PID 800 wrote to memory of 1028 800 cmd.exe timeout.exe PID 800 wrote to memory of 1616 800 cmd.exe vlc.exe PID 800 wrote to memory of 1616 800 cmd.exe vlc.exe PID 800 wrote to memory of 1616 800 cmd.exe vlc.exe PID 800 wrote to memory of 1616 800 cmd.exe vlc.exe PID 1616 wrote to memory of 1504 1616 vlc.exe schtasks.exe PID 1616 wrote to memory of 1504 1616 vlc.exe schtasks.exe PID 1616 wrote to memory of 1504 1616 vlc.exe schtasks.exe PID 1616 wrote to memory of 1504 1616 vlc.exe schtasks.exe PID 1616 wrote to memory of 1608 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1608 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1608 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1608 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1992 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1992 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1992 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1992 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1536 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1536 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1536 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1536 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1568 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1568 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1568 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1568 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1524 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1524 1616 vlc.exe vlc.exe PID 1616 wrote to memory of 1524 1616 vlc.exe vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IapdeqiYxjrvsQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC70.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC39E.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IapdeqiYxjrvsQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6FF.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txtFilesize
619B
MD5dd4c9d18d412811d8c0da01d6b465703
SHA1061cf7b8dcb6b0be2834c5795b2f5ec917791380
SHA2565532fc69b2753a1a303a55945098f139570da207b7230857efa994f3759b3bc5
SHA512bb6ff296e0893237b8ab92bec484e0f35956d0b45c7ef7fc2827e054ebf3763278d57e51d0190df61ba97ffbe08f7d26b8ec6aff0ec9eaee7008fb45b3cba5a6
-
C:\Users\Admin\AppData\Local\Temp\tmpC39E.tmp.batFilesize
156B
MD5c0129017e1f1dfd85de7e6fc11e8adc1
SHA1b0a1b7edec8a5e7d2b47bf5e03cd67e62b8d70fe
SHA2569b76f48a22b668bcbf36feb67bafa528009b3ff87d73b65d2a9fa42c47715762
SHA5126b54f426fa7035703bfbc5fad3bef6f5df1729edfe2e8e713d77a45d7a274c0287ce1bbc74a5f68737c7dcfb9d9153b071e45b722d2bdb72046b3cacd9659622
-
C:\Users\Admin\AppData\Local\Temp\tmpC70.tmpFilesize
1KB
MD5ac6d80bf25675aefd5cc746dfbf63b04
SHA1421facc246f710e1e0abc25c8f8f518890d149d6
SHA256f580a5f04654984fd80701c64fd2339547db3f7b6fc4abafae20961c80921680
SHA5121268c557f06e7b5b76cc0c94efdd88d342fa9f07edd94a6f691974dc58c69d1456baa255263ca57c95a370d9ae5274541c730140d83402f5b1d6fc1d0aea5602
-
C:\Users\Admin\AppData\Local\Temp\tmpD6FF.tmpFilesize
1KB
MD5ac6d80bf25675aefd5cc746dfbf63b04
SHA1421facc246f710e1e0abc25c8f8f518890d149d6
SHA256f580a5f04654984fd80701c64fd2339547db3f7b6fc4abafae20961c80921680
SHA5121268c557f06e7b5b76cc0c94efdd88d342fa9f07edd94a6f691974dc58c69d1456baa255263ca57c95a370d9ae5274541c730140d83402f5b1d6fc1d0aea5602
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
\Users\Admin\AppData\Roaming\VideoLAN\vlc.exeFilesize
709KB
MD5e6f2ef791f0ec1869a975fa14248e8a1
SHA1bca1cf7d10b095100273065d9e59fd1107afd353
SHA256c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500
SHA512247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b
-
memory/800-573-0x0000000000000000-mapping.dmp
-
memory/1028-576-0x0000000000000000-mapping.dmp
-
memory/1120-58-0x0000000000000000-mapping.dmp
-
memory/1504-583-0x0000000000000000-mapping.dmp
-
memory/1524-595-0x00000000004A1A5E-mapping.dmp
-
memory/1524-601-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1616-581-0x0000000000260000-0x0000000000318000-memory.dmpFilesize
736KB
-
memory/1616-579-0x0000000000000000-mapping.dmp
-
memory/1628-572-0x0000000000000000-mapping.dmp
-
memory/1668-574-0x0000000000000000-mapping.dmp
-
memory/1732-74-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-86-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-92-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-94-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-96-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-98-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-100-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-102-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-104-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-108-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-106-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-110-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-112-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-114-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-116-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-118-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-120-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-122-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-88-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-90-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-84-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-82-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-80-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-78-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-76-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-60-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-72-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-70-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-68-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-66-0x00000000004A1A5E-mapping.dmp
-
memory/1732-65-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-64-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-63-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1732-61-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1980-54-0x00000000002B0000-0x0000000000368000-memory.dmpFilesize
736KB
-
memory/1980-57-0x0000000005170000-0x000000000521E000-memory.dmpFilesize
696KB
-
memory/1980-56-0x00000000002A0000-0x00000000002A8000-memory.dmpFilesize
32KB
-
memory/1980-55-0x00000000768D1000-0x00000000768D3000-memory.dmpFilesize
8KB