Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2023 18:10
Static task
static1
Behavioral task
behavioral1
Sample
9fab4fe1086f37247ca27d6d66a3cbcb72400bf1bbf567665652d41034ecb660.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9fab4fe1086f37247ca27d6d66a3cbcb72400bf1bbf567665652d41034ecb660.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe
Resource
win10v2004-20230220-en
General
-
Target
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe
-
Size
661KB
-
MD5
d793dff0e3e0046d9f13c9b75d4d67a1
-
SHA1
2357b41b9a5d5d4880cdfc76724bc96931e9e643
-
SHA256
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98
-
SHA512
2bcde02d15c5497ab0a17d445abc9a7b4bccd50732ace2b2d99e6820d420a16b76262a5ff6472389733e1f71e33de7ff9fcecfdc99c5630a0666bc8539f602e3
-
SSDEEP
12288:AMx+hr1rttGnqqzhY/RG5/weutM7eiWZ0rgkHgqmCSni7KtaNy3P4Z95lW0pDl:pkrPGn3aImeutR0ZHgd67KtaNGAZ9GI
Malware Config
Extracted
Protocol: smtp- Host:
mail.tcci.org.sa - Port:
587 - Username:
khedre@tcci.org.sa - Password:
Brown3044
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral4/memory/264-137-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral4/memory/4476-162-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral4/memory/4476-164-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral4/memory/4476-165-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral4/memory/4476-167-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral4/memory/264-137-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral4/memory/3816-171-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral4/memory/3816-173-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral4/memory/3816-177-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral4/memory/3816-181-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 9 IoCs
Processes:
resource yara_rule behavioral4/memory/264-137-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral4/memory/4476-162-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral4/memory/4476-164-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral4/memory/4476-165-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral4/memory/4476-167-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral4/memory/3816-171-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral4/memory/3816-173-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral4/memory/3816-177-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral4/memory/3816-181-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 2380 Windows Update.exe 1952 Windows Update.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Windows Update.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exedescription ioc process File created C:\Windows\assembly\Desktop.ini d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe File opened for modification C:\Windows\assembly\Desktop.ini d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 whatismyipaddress.com 14 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exeWindows Update.exeWindows Update.exedescription pid process target process PID 1044 set thread context of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 2380 set thread context of 1952 2380 Windows Update.exe Windows Update.exe PID 1952 set thread context of 4476 1952 Windows Update.exe vbc.exe PID 1952 set thread context of 3816 1952 Windows Update.exe vbc.exe -
Drops file in Windows directory 3 IoCs
Processes:
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exedescription ioc process File opened for modification C:\Windows\assembly d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe File created C:\Windows\assembly\Desktop.ini d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe File opened for modification C:\Windows\assembly\Desktop.ini d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exeWindows Update.exeWindows Update.exepid process 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe 2380 Windows Update.exe 2380 Windows Update.exe 2380 Windows Update.exe 2380 Windows Update.exe 2380 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 2380 Windows Update.exe 2380 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe 1952 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exeWindows Update.exeWindows Update.exedescription pid process Token: SeDebugPrivilege 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe Token: SeDebugPrivilege 2380 Windows Update.exe Token: SeDebugPrivilege 1952 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Update.exepid process 1952 Windows Update.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exed2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exeWindows Update.exeWindows Update.exedescription pid process target process PID 1044 wrote to memory of 4928 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe cmd.exe PID 1044 wrote to memory of 4928 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe cmd.exe PID 1044 wrote to memory of 4928 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe cmd.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 1044 wrote to memory of 264 1044 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe PID 264 wrote to memory of 2380 264 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe Windows Update.exe PID 264 wrote to memory of 2380 264 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe Windows Update.exe PID 264 wrote to memory of 2380 264 d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe Windows Update.exe PID 2380 wrote to memory of 4804 2380 Windows Update.exe cmd.exe PID 2380 wrote to memory of 4804 2380 Windows Update.exe cmd.exe PID 2380 wrote to memory of 4804 2380 Windows Update.exe cmd.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 2380 wrote to memory of 1952 2380 Windows Update.exe Windows Update.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 4476 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe PID 1952 wrote to memory of 3816 1952 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe"C:\Users\Admin\AppData\Local\Temp\d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe"C:\Users\Admin\AppData\Local\Temp\d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD56e45457a23d0e813a664786eff397389
SHA1e819e1d2e29f1ef81dcc779fd514bdc21a38b1f6
SHA2566641419d2a47de562312be1161f08911e3034ab08d42d2cca5ffe6cd6a47b6ff
SHA512cee3080bf8027823d7b6abda2c0d5b8d19cee57e72499eb04046131c64b569528a4f7aca8b8da8c56468df7d78958961f6535dc44e26d91cb0b98ae1c3e63f59
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
89KB
MD584c42d0f2c1ae761bef884638bc1eacd
SHA14353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA51243c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
661KB
MD5d793dff0e3e0046d9f13c9b75d4d67a1
SHA12357b41b9a5d5d4880cdfc76724bc96931e9e643
SHA256d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98
SHA5122bcde02d15c5497ab0a17d445abc9a7b4bccd50732ace2b2d99e6820d420a16b76262a5ff6472389733e1f71e33de7ff9fcecfdc99c5630a0666bc8539f602e3
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
661KB
MD5d793dff0e3e0046d9f13c9b75d4d67a1
SHA12357b41b9a5d5d4880cdfc76724bc96931e9e643
SHA256d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98
SHA5122bcde02d15c5497ab0a17d445abc9a7b4bccd50732ace2b2d99e6820d420a16b76262a5ff6472389733e1f71e33de7ff9fcecfdc99c5630a0666bc8539f602e3
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
661KB
MD5d793dff0e3e0046d9f13c9b75d4d67a1
SHA12357b41b9a5d5d4880cdfc76724bc96931e9e643
SHA256d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98
SHA5122bcde02d15c5497ab0a17d445abc9a7b4bccd50732ace2b2d99e6820d420a16b76262a5ff6472389733e1f71e33de7ff9fcecfdc99c5630a0666bc8539f602e3
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
661KB
MD5d793dff0e3e0046d9f13c9b75d4d67a1
SHA12357b41b9a5d5d4880cdfc76724bc96931e9e643
SHA256d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98
SHA5122bcde02d15c5497ab0a17d445abc9a7b4bccd50732ace2b2d99e6820d420a16b76262a5ff6472389733e1f71e33de7ff9fcecfdc99c5630a0666bc8539f602e3
-
memory/264-142-0x00000000017E0000-0x00000000017F0000-memory.dmpFilesize
64KB
-
memory/264-138-0x00000000017E0000-0x00000000017F0000-memory.dmpFilesize
64KB
-
memory/264-137-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1044-133-0x00000000008B0000-0x00000000008C0000-memory.dmpFilesize
64KB
-
memory/1952-169-0x00000000016D0000-0x00000000016E0000-memory.dmpFilesize
64KB
-
memory/1952-154-0x00000000016D0000-0x00000000016E0000-memory.dmpFilesize
64KB
-
memory/1952-156-0x00000000016D0000-0x00000000016E0000-memory.dmpFilesize
64KB
-
memory/1952-170-0x00000000016D0000-0x00000000016E0000-memory.dmpFilesize
64KB
-
memory/2380-155-0x0000000000BF0000-0x0000000000C00000-memory.dmpFilesize
64KB
-
memory/3816-171-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3816-173-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3816-177-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3816-181-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4476-167-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4476-166-0x0000000000420000-0x00000000004E9000-memory.dmpFilesize
804KB
-
memory/4476-165-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4476-164-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4476-162-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB