Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2023 14:34
Static task
static1
Behavioral task
behavioral1
Sample
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe
Resource
win10v2004-20230221-en
General
-
Target
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe
-
Size
654KB
-
MD5
eef5220a2f4e2271672abc644e563e45
-
SHA1
cb551ad223063517d67e18622044b406ef40c9d3
-
SHA256
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb
-
SHA512
6154d678cd118677b0d54d33bd31fcad397cc650f443c438c5cdf4e9a0a5a210a006cbe61ce7fdedad381eded57c8fe25a2c34fe1a9bef3e97f657c9738b5eb0
-
SSDEEP
12288:gXQnnE6+s3WsZ/lkwR939lgKFWRg1xY0VcRuaHuatAUz3huJ7XrjaJ+:gXQnnYsNHXR9NlgobVcUK7UXrj++
Malware Config
Extracted
Protocol: smtp- Host:
mail.tcci.org.sa - Port:
587 - Username:
fahad.s@tcci.org.sa - Password:
Brown3044
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3728-137-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral2/memory/4600-161-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4600-163-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4600-165-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3728-137-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral2/memory/1976-170-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1976-172-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1976-179-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3728-137-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral2/memory/4600-161-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4600-163-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4600-165-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1976-170-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1976-172-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1976-179-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 1416 Windows Update.exe 3532 Windows Update.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Windows Update.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe File opened for modification C:\Windows\assembly\Desktop.ini 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 whatismyipaddress.com 16 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exeWindows Update.exeWindows Update.exedescription pid process target process PID 2116 set thread context of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 1416 set thread context of 3532 1416 Windows Update.exe Windows Update.exe PID 3532 set thread context of 4600 3532 Windows Update.exe vbc.exe PID 3532 set thread context of 1976 3532 Windows Update.exe vbc.exe -
Drops file in Windows directory 3 IoCs
Processes:
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe File opened for modification C:\Windows\assembly\Desktop.ini 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe File opened for modification C:\Windows\assembly 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exeWindows Update.exeWindows Update.exepid process 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 1416 Windows Update.exe 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 1416 Windows Update.exe 1416 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 1416 Windows Update.exe 1416 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 1416 Windows Update.exe 1416 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe 3532 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exeWindows Update.exeWindows Update.exedescription pid process Token: SeDebugPrivilege 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe Token: SeDebugPrivilege 1416 Windows Update.exe Token: SeDebugPrivilege 3532 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Update.exepid process 3532 Windows Update.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exeWindows Update.exeWindows Update.exedescription pid process target process PID 2116 wrote to memory of 2748 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe cmd.exe PID 2116 wrote to memory of 2748 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe cmd.exe PID 2116 wrote to memory of 2748 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe cmd.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 2116 wrote to memory of 3728 2116 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe PID 3728 wrote to memory of 1416 3728 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe Windows Update.exe PID 3728 wrote to memory of 1416 3728 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe Windows Update.exe PID 3728 wrote to memory of 1416 3728 2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe Windows Update.exe PID 1416 wrote to memory of 4344 1416 Windows Update.exe cmd.exe PID 1416 wrote to memory of 4344 1416 Windows Update.exe cmd.exe PID 1416 wrote to memory of 4344 1416 Windows Update.exe cmd.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 1416 wrote to memory of 3532 1416 Windows Update.exe Windows Update.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 4600 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe PID 3532 wrote to memory of 1976 3532 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe"C:\Users\Admin\AppData\Local\Temp\2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe"C:\Users\Admin\AppData\Local\Temp\2d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD5e0f71f119d02e3fbe1abba1d0e05ef6d
SHA1ce9e534aaf02bd378cd4b2166e8f647cfd5ba448
SHA256b66ff65e753fba4e9ece5c6804d1f993b4e5faeff69e7023e6f26939dbeb582b
SHA5123b6ac8f9f62057d79dcfb677db477364b4d31f3b800d7e8fed23d90d8e3fe815b0cf687a69e5577105e6f8816c83f9eddddc5e600973d6113ed2cab455a7496a
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
89KB
MD584c42d0f2c1ae761bef884638bc1eacd
SHA14353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA51243c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
654KB
MD5eef5220a2f4e2271672abc644e563e45
SHA1cb551ad223063517d67e18622044b406ef40c9d3
SHA2562d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb
SHA5126154d678cd118677b0d54d33bd31fcad397cc650f443c438c5cdf4e9a0a5a210a006cbe61ce7fdedad381eded57c8fe25a2c34fe1a9bef3e97f657c9738b5eb0
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
654KB
MD5eef5220a2f4e2271672abc644e563e45
SHA1cb551ad223063517d67e18622044b406ef40c9d3
SHA2562d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb
SHA5126154d678cd118677b0d54d33bd31fcad397cc650f443c438c5cdf4e9a0a5a210a006cbe61ce7fdedad381eded57c8fe25a2c34fe1a9bef3e97f657c9738b5eb0
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
654KB
MD5eef5220a2f4e2271672abc644e563e45
SHA1cb551ad223063517d67e18622044b406ef40c9d3
SHA2562d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb
SHA5126154d678cd118677b0d54d33bd31fcad397cc650f443c438c5cdf4e9a0a5a210a006cbe61ce7fdedad381eded57c8fe25a2c34fe1a9bef3e97f657c9738b5eb0
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
654KB
MD5eef5220a2f4e2271672abc644e563e45
SHA1cb551ad223063517d67e18622044b406ef40c9d3
SHA2562d1cb79740ad3c65afdc693f5d5bc31c425d88a33bcd2d4f6d8044231b1427eb
SHA5126154d678cd118677b0d54d33bd31fcad397cc650f443c438c5cdf4e9a0a5a210a006cbe61ce7fdedad381eded57c8fe25a2c34fe1a9bef3e97f657c9738b5eb0
-
memory/1416-166-0x0000000000D20000-0x0000000000D30000-memory.dmpFilesize
64KB
-
memory/1416-151-0x0000000000D20000-0x0000000000D30000-memory.dmpFilesize
64KB
-
memory/1976-179-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1976-172-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1976-170-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2116-133-0x0000000001180000-0x0000000001190000-memory.dmpFilesize
64KB
-
memory/3532-168-0x0000000000B50000-0x0000000000B60000-memory.dmpFilesize
64KB
-
memory/3532-154-0x0000000000B50000-0x0000000000B60000-memory.dmpFilesize
64KB
-
memory/3532-155-0x0000000000B50000-0x0000000000B60000-memory.dmpFilesize
64KB
-
memory/3532-169-0x0000000000B50000-0x0000000000B60000-memory.dmpFilesize
64KB
-
memory/3728-141-0x0000000001510000-0x0000000001520000-memory.dmpFilesize
64KB
-
memory/3728-137-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/4600-165-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4600-163-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4600-161-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB