Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 16:01
Static task
static1
Behavioral task
behavioral1
Sample
ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe
Resource
win10v2004-20220901-en
General
-
Target
ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe
-
Size
153KB
-
MD5
7bd537a8dfa91ec83e264ceefe3f0e26
-
SHA1
b1ffa33c2760f23d4de2900907273c9736f82557
-
SHA256
ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff
-
SHA512
1bac14ae3681a9aefc99f11a6be9dd997f99a1d8c2f8f36d1397c7344440fbf02b9df6867b27b9b38aaa710e2cabff40f5ba38b1fdd3118c81f322d6d1033562
-
SSDEEP
1536:U3SgqQYcZsSPTyGTc5BZOsv0sCXhlJpVTbXQ5VEPl4SknT5jmFQtjYj1Ei/WV/Jz:UCgJfJTc5TZeXFTbXQAGSc5+vBaNl5B
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2296-133-0x00000000006A0000-0x00000000006A9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 115 1568 rundll32.exe 124 1568 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
50C0.exeBF98.exepid process 3556 50C0.exe 2508 BF98.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1320 3556 WerFault.exe 50C0.exe -
Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exesvchost.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exepid process 2296 ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe 2296 ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 2248 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2248 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exepid process 2296 ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeBF98.exedescription pid process Token: SeShutdownPrivilege 4680 svchost.exe Token: SeShutdownPrivilege 4680 svchost.exe Token: SeCreatePagefilePrivilege 4680 svchost.exe Token: SeDebugPrivilege 2508 BF98.exe Token: SeShutdownPrivilege 2248 Token: SeCreatePagefilePrivilege 2248 -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
50C0.exedescription pid process target process PID 2248 wrote to memory of 3556 2248 50C0.exe PID 2248 wrote to memory of 3556 2248 50C0.exe PID 2248 wrote to memory of 3556 2248 50C0.exe PID 3556 wrote to memory of 868 3556 50C0.exe agentactivationruntimestarter.exe PID 3556 wrote to memory of 868 3556 50C0.exe agentactivationruntimestarter.exe PID 3556 wrote to memory of 868 3556 50C0.exe agentactivationruntimestarter.exe PID 2248 wrote to memory of 2508 2248 BF98.exe PID 2248 wrote to memory of 2508 2248 BF98.exe PID 2248 wrote to memory of 2508 2248 BF98.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe PID 3556 wrote to memory of 1568 3556 50C0.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe"C:\Users\Admin\AppData\Local\Temp\ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\50C0.exeC:\Users\Admin\AppData\Local\Temp\50C0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 5282⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x454 0x5041⤵
-
C:\Users\Admin\AppData\Local\Temp\BF98.exeC:\Users\Admin\AppData\Local\Temp\BF98.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3556 -ip 35561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\50C0.exeFilesize
1.2MB
MD5ca6efc760f3ed4fdcf9c8872e273a05a
SHA1bbf446b4fd9502dfc29f82cd96f740dc1345781a
SHA25662ef1e13afc32dbc6c19c6de8bae14acf26424dedea85341e4b307bce8145609
SHA512c79bebab9758693036524194bc1d88298f46aad142c8364f363096ed1ec2d7ee214fa155a4e9ac73adfced99185333fbb14e596b5298f165cabca66114378be5
-
C:\Users\Admin\AppData\Local\Temp\50C0.exeFilesize
1.2MB
MD5ca6efc760f3ed4fdcf9c8872e273a05a
SHA1bbf446b4fd9502dfc29f82cd96f740dc1345781a
SHA25662ef1e13afc32dbc6c19c6de8bae14acf26424dedea85341e4b307bce8145609
SHA512c79bebab9758693036524194bc1d88298f46aad142c8364f363096ed1ec2d7ee214fa155a4e9ac73adfced99185333fbb14e596b5298f165cabca66114378be5
-
C:\Users\Admin\AppData\Local\Temp\BF98.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\BF98.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
memory/868-139-0x0000000000000000-mapping.dmp
-
memory/1568-161-0x0000000000480000-0x0000000000484000-memory.dmpFilesize
16KB
-
memory/1568-160-0x0000000000470000-0x0000000000474000-memory.dmpFilesize
16KB
-
memory/1568-159-0x0000000000460000-0x0000000000464000-memory.dmpFilesize
16KB
-
memory/1568-158-0x0000000000000000-mapping.dmp
-
memory/2296-134-0x0000000000400000-0x0000000000583000-memory.dmpFilesize
1.5MB
-
memory/2296-135-0x0000000000400000-0x0000000000583000-memory.dmpFilesize
1.5MB
-
memory/2296-132-0x00000000006D8000-0x00000000006E9000-memory.dmpFilesize
68KB
-
memory/2296-133-0x00000000006A0000-0x00000000006A9000-memory.dmpFilesize
36KB
-
memory/2508-155-0x00000000008D9000-0x0000000000903000-memory.dmpFilesize
168KB
-
memory/2508-154-0x0000000005AD0000-0x0000000005B0C000-memory.dmpFilesize
240KB
-
memory/2508-149-0x0000000004DA0000-0x0000000005344000-memory.dmpFilesize
5.6MB
-
memory/2508-148-0x0000000000800000-0x0000000000837000-memory.dmpFilesize
220KB
-
memory/2508-150-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/2508-147-0x00000000008D9000-0x0000000000903000-memory.dmpFilesize
168KB
-
memory/2508-151-0x0000000005350000-0x0000000005968000-memory.dmpFilesize
6.1MB
-
memory/2508-152-0x0000000004D60000-0x0000000004D72000-memory.dmpFilesize
72KB
-
memory/2508-153-0x0000000005970000-0x0000000005A7A000-memory.dmpFilesize
1.0MB
-
memory/2508-144-0x0000000000000000-mapping.dmp
-
memory/3556-136-0x0000000000000000-mapping.dmp
-
memory/3556-156-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/3556-157-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/3556-143-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/3556-142-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/3556-141-0x0000000002570000-0x000000000284B000-memory.dmpFilesize
2.9MB
-
memory/3556-140-0x0000000002442000-0x0000000002568000-memory.dmpFilesize
1.1MB
-
memory/3556-162-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB