Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2023 22:51
Static task
static1
General
-
Target
cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe
-
Size
246KB
-
MD5
c3930d1f11425f93631557cb762e32fd
-
SHA1
498320119f85c455cc5dca8f2aa60aa9290de90f
-
SHA256
cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586
-
SHA512
d4c62aa173ce314c91104db30d6032c5e6c501cb4094aa761edb1e55e66c7b645b3e834db590da2d5c3e7550865cdfd191f4282588e262211d5dce3445babfa5
-
SSDEEP
3072:mZ2xVf/LeleqnDDRpRF/k0OjIJA6bKIXYOU8R0c2M2ZdnVUkF:sEx/LelZDbdiiZoO1R0c2M2Zd
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5004-133-0x0000000000520000-0x0000000000529000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2E64.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2E64.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2E64.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2E64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2E64.exe -
Executes dropped EXE 4 IoCs
Processes:
20F5.exe2E64.exe327C.exe3BE3.exepid process 4004 20F5.exe 1940 2E64.exe 1796 327C.exe 4400 3BE3.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1940-150-0x00000000009E0000-0x00000000016EE000-memory.dmp agile_net behavioral1/memory/1940-151-0x00000000009E0000-0x00000000016EE000-memory.dmp agile_net behavioral1/memory/1940-204-0x00000000009E0000-0x00000000016EE000-memory.dmp agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\2E64.exe themida C:\Users\Admin\AppData\Local\Temp\2E64.exe themida behavioral1/memory/1940-150-0x00000000009E0000-0x00000000016EE000-memory.dmp themida behavioral1/memory/1940-151-0x00000000009E0000-0x00000000016EE000-memory.dmp themida behavioral1/memory/1940-204-0x00000000009E0000-0x00000000016EE000-memory.dmp themida -
Uses the VBS compiler for execution 1 TTPs
-
Processes:
2E64.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2E64.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 84 ip-api.com 92 icanhazip.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
327C.exedescription pid process target process PID 1796 set thread context of 4512 1796 327C.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4328 1796 WerFault.exe 327C.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2E64.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2E64.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 2E64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2E64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2E64.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exepid process 5004 cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe 5004 cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2664 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exepid process 5004 cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
2E64.exemsiexec.exevbc.exedescription pid process Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeDebugPrivilege 1940 2E64.exe Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeSecurityPrivilege 3400 msiexec.exe Token: SeDebugPrivilege 4512 vbc.exe Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 Token: SeShutdownPrivilege 2664 Token: SeCreatePagefilePrivilege 2664 -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
327C.exedescription pid process target process PID 2664 wrote to memory of 4004 2664 20F5.exe PID 2664 wrote to memory of 4004 2664 20F5.exe PID 2664 wrote to memory of 1940 2664 2E64.exe PID 2664 wrote to memory of 1940 2664 2E64.exe PID 2664 wrote to memory of 1940 2664 2E64.exe PID 2664 wrote to memory of 1796 2664 327C.exe PID 2664 wrote to memory of 1796 2664 327C.exe PID 2664 wrote to memory of 1796 2664 327C.exe PID 2664 wrote to memory of 4400 2664 3BE3.exe PID 2664 wrote to memory of 4400 2664 3BE3.exe PID 1796 wrote to memory of 4512 1796 327C.exe vbc.exe PID 1796 wrote to memory of 4512 1796 327C.exe vbc.exe PID 1796 wrote to memory of 4512 1796 327C.exe vbc.exe PID 1796 wrote to memory of 4512 1796 327C.exe vbc.exe PID 1796 wrote to memory of 4512 1796 327C.exe vbc.exe PID 2664 wrote to memory of 1976 2664 explorer.exe PID 2664 wrote to memory of 1976 2664 explorer.exe PID 2664 wrote to memory of 1976 2664 explorer.exe PID 2664 wrote to memory of 1976 2664 explorer.exe PID 2664 wrote to memory of 4244 2664 explorer.exe PID 2664 wrote to memory of 4244 2664 explorer.exe PID 2664 wrote to memory of 4244 2664 explorer.exe PID 2664 wrote to memory of 3700 2664 explorer.exe PID 2664 wrote to memory of 3700 2664 explorer.exe PID 2664 wrote to memory of 3700 2664 explorer.exe PID 2664 wrote to memory of 3700 2664 explorer.exe PID 2664 wrote to memory of 4568 2664 explorer.exe PID 2664 wrote to memory of 4568 2664 explorer.exe PID 2664 wrote to memory of 4568 2664 explorer.exe PID 2664 wrote to memory of 3760 2664 explorer.exe PID 2664 wrote to memory of 3760 2664 explorer.exe PID 2664 wrote to memory of 3760 2664 explorer.exe PID 2664 wrote to memory of 3760 2664 explorer.exe PID 2664 wrote to memory of 2184 2664 explorer.exe PID 2664 wrote to memory of 2184 2664 explorer.exe PID 2664 wrote to memory of 2184 2664 explorer.exe PID 2664 wrote to memory of 2184 2664 explorer.exe PID 2664 wrote to memory of 1440 2664 explorer.exe PID 2664 wrote to memory of 1440 2664 explorer.exe PID 2664 wrote to memory of 1440 2664 explorer.exe PID 2664 wrote to memory of 1440 2664 explorer.exe PID 2664 wrote to memory of 1596 2664 explorer.exe PID 2664 wrote to memory of 1596 2664 explorer.exe PID 2664 wrote to memory of 1596 2664 explorer.exe PID 2664 wrote to memory of 2024 2664 explorer.exe PID 2664 wrote to memory of 2024 2664 explorer.exe PID 2664 wrote to memory of 2024 2664 explorer.exe PID 2664 wrote to memory of 2024 2664 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe"C:\Users\Admin\AppData\Local\Temp\cb3c83da32f0b4243c341c37e9865ddaaa0a612b333f372671e3610fb8b8f586.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\20F5.exeC:\Users\Admin\AppData\Local\Temp\20F5.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2E64.exeC:\Users\Admin\AppData\Local\Temp\2E64.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\327C.exeC:\Users\Admin\AppData\Local\Temp\327C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 2482⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3BE3.exeC:\Users\Admin\AppData\Local\Temp\3BE3.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1796 -ip 17961⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\20F5.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\20F5.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\2E64.exeFilesize
5.3MB
MD5870406ba58703185ab2c177bd7c1ecaf
SHA1e5f688ee7319c5391ccc3215f4cae5323870aca9
SHA256256c47ac22e3569ad793c5a687f4f7a2e8835e4a33e1585fbf7625c4d760643e
SHA512f63f8c9d4613c0de73df3ba11cb9331889bbfbb6219873bd7ddd503b2e9d85fe0cd2a5ef349f7567a7cad3bade33a068c5007a7cf83417cb7da00294b69727a2
-
C:\Users\Admin\AppData\Local\Temp\2E64.exeFilesize
5.3MB
MD5870406ba58703185ab2c177bd7c1ecaf
SHA1e5f688ee7319c5391ccc3215f4cae5323870aca9
SHA256256c47ac22e3569ad793c5a687f4f7a2e8835e4a33e1585fbf7625c4d760643e
SHA512f63f8c9d4613c0de73df3ba11cb9331889bbfbb6219873bd7ddd503b2e9d85fe0cd2a5ef349f7567a7cad3bade33a068c5007a7cf83417cb7da00294b69727a2
-
C:\Users\Admin\AppData\Local\Temp\327C.exeFilesize
1.1MB
MD5b5cd4deb250cbeda544d8622d7ed90bf
SHA1d8f784eba044a176e935cd6bc9a97d346a810c98
SHA2568f4b3502e38100486b960ef7d7aea1c43ba2ba38f5d31439b1ae9324c3f43621
SHA5121a828445c797a4af0279eb2d0ba2e973b2768da5eeec6ebc42c104a1bf689268798380b8da2496757d7ee0e61f10cadadc7369fb5cb535d13260d7721562f2ae
-
C:\Users\Admin\AppData\Local\Temp\327C.exeFilesize
1.1MB
MD5b5cd4deb250cbeda544d8622d7ed90bf
SHA1d8f784eba044a176e935cd6bc9a97d346a810c98
SHA2568f4b3502e38100486b960ef7d7aea1c43ba2ba38f5d31439b1ae9324c3f43621
SHA5121a828445c797a4af0279eb2d0ba2e973b2768da5eeec6ebc42c104a1bf689268798380b8da2496757d7ee0e61f10cadadc7369fb5cb535d13260d7721562f2ae
-
C:\Users\Admin\AppData\Local\Temp\3BE3.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\3BE3.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
memory/1440-194-0x0000000000000000-mapping.dmp
-
memory/1440-210-0x0000000000C60000-0x0000000000C66000-memory.dmpFilesize
24KB
-
memory/1440-195-0x0000000000C60000-0x0000000000C66000-memory.dmpFilesize
24KB
-
memory/1440-196-0x0000000000C50000-0x0000000000C5B000-memory.dmpFilesize
44KB
-
memory/1596-197-0x0000000000000000-mapping.dmp
-
memory/1596-199-0x0000000000B30000-0x0000000000B37000-memory.dmpFilesize
28KB
-
memory/1596-200-0x0000000000B20000-0x0000000000B2D000-memory.dmpFilesize
52KB
-
memory/1596-211-0x0000000000B30000-0x0000000000B37000-memory.dmpFilesize
28KB
-
memory/1796-147-0x0000000000000000-mapping.dmp
-
memory/1796-158-0x00000000002C0000-0x00000000003D8000-memory.dmpFilesize
1.1MB
-
memory/1940-150-0x00000000009E0000-0x00000000016EE000-memory.dmpFilesize
13.1MB
-
memory/1940-141-0x0000000000000000-mapping.dmp
-
memory/1940-151-0x00000000009E0000-0x00000000016EE000-memory.dmpFilesize
13.1MB
-
memory/1940-188-0x00000000009E0000-0x00000000016EE000-memory.dmpFilesize
13.1MB
-
memory/1940-152-0x00000000034E0000-0x0000000003546000-memory.dmpFilesize
408KB
-
memory/1940-204-0x00000000009E0000-0x00000000016EE000-memory.dmpFilesize
13.1MB
-
memory/1940-144-0x00000000009E0000-0x00000000016EE000-memory.dmpFilesize
13.1MB
-
memory/1976-205-0x00000000014D0000-0x00000000014D7000-memory.dmpFilesize
28KB
-
memory/1976-172-0x00000000014D0000-0x00000000014D7000-memory.dmpFilesize
28KB
-
memory/1976-168-0x0000000000000000-mapping.dmp
-
memory/1976-173-0x00000000014C0000-0x00000000014CB000-memory.dmpFilesize
44KB
-
memory/2024-203-0x00000000003D0000-0x00000000003DB000-memory.dmpFilesize
44KB
-
memory/2024-201-0x0000000000000000-mapping.dmp
-
memory/2024-212-0x00000000003E0000-0x00000000003E8000-memory.dmpFilesize
32KB
-
memory/2024-202-0x00000000003E0000-0x00000000003E8000-memory.dmpFilesize
32KB
-
memory/2184-192-0x00000000014A0000-0x00000000014A5000-memory.dmpFilesize
20KB
-
memory/2184-209-0x00000000014A0000-0x00000000014A5000-memory.dmpFilesize
20KB
-
memory/2184-191-0x0000000000000000-mapping.dmp
-
memory/2184-193-0x0000000001490000-0x0000000001499000-memory.dmpFilesize
36KB
-
memory/3700-182-0x00000000003D0000-0x00000000003D5000-memory.dmpFilesize
20KB
-
memory/3700-207-0x00000000003D0000-0x00000000003D5000-memory.dmpFilesize
20KB
-
memory/3700-181-0x0000000000000000-mapping.dmp
-
memory/3700-183-0x00000000003C0000-0x00000000003C9000-memory.dmpFilesize
36KB
-
memory/3760-208-0x00000000014F0000-0x0000000001512000-memory.dmpFilesize
136KB
-
memory/3760-189-0x00000000014F0000-0x0000000001512000-memory.dmpFilesize
136KB
-
memory/3760-187-0x0000000000000000-mapping.dmp
-
memory/3760-190-0x00000000014C0000-0x00000000014E7000-memory.dmpFilesize
156KB
-
memory/4004-139-0x0000000000010000-0x0000000000018000-memory.dmpFilesize
32KB
-
memory/4004-140-0x00007FFD50A70000-0x00007FFD51531000-memory.dmpFilesize
10.8MB
-
memory/4004-136-0x0000000000000000-mapping.dmp
-
memory/4244-178-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/4244-179-0x00000000005F0000-0x00000000005FF000-memory.dmpFilesize
60KB
-
memory/4244-206-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/4244-175-0x0000000000000000-mapping.dmp
-
memory/4400-153-0x0000000000000000-mapping.dmp
-
memory/4400-198-0x00007FFD50A70000-0x00007FFD51531000-memory.dmpFilesize
10.8MB
-
memory/4400-162-0x00007FFD50A70000-0x00007FFD51531000-memory.dmpFilesize
10.8MB
-
memory/4512-156-0x0000000000000000-mapping.dmp
-
memory/4512-177-0x0000000008050000-0x000000000857C000-memory.dmpFilesize
5.2MB
-
memory/4512-166-0x0000000005210000-0x000000000531A000-memory.dmpFilesize
1.0MB
-
memory/4512-165-0x00000000050E0000-0x00000000050F2000-memory.dmpFilesize
72KB
-
memory/4512-164-0x0000000005550000-0x0000000005B68000-memory.dmpFilesize
6.1MB
-
memory/4512-170-0x0000000006060000-0x00000000060F2000-memory.dmpFilesize
584KB
-
memory/4512-174-0x0000000006150000-0x00000000061C6000-memory.dmpFilesize
472KB
-
memory/4512-157-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4512-169-0x0000000006520000-0x0000000006AC4000-memory.dmpFilesize
5.6MB
-
memory/4512-171-0x0000000006100000-0x0000000006150000-memory.dmpFilesize
320KB
-
memory/4512-176-0x0000000007950000-0x0000000007B12000-memory.dmpFilesize
1.8MB
-
memory/4512-167-0x0000000005140000-0x000000000517C000-memory.dmpFilesize
240KB
-
memory/4512-180-0x00000000064B0000-0x00000000064CE000-memory.dmpFilesize
120KB
-
memory/4568-184-0x0000000000000000-mapping.dmp
-
memory/4568-185-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/4568-186-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/5004-132-0x000000000057C000-0x0000000000591000-memory.dmpFilesize
84KB
-
memory/5004-135-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/5004-134-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/5004-133-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB