Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2023 15:16
Static task
static1
Behavioral task
behavioral1
Sample
ordine pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ordine pdf.exe
Resource
win10v2004-20230220-en
General
-
Target
ordine pdf.exe
-
Size
765KB
-
MD5
e5d280126390518473146d3a8b7818e1
-
SHA1
3af84d1a32b1a834e9d74ad8743d835ab00b3702
-
SHA256
323dc9de135c89b75b7a42b2c5a6327e09acafe52c035464316e170f3f55b6ac
-
SHA512
a1849d82d202105aded3ae93ec9a7b12366f6112f87fa8adbefc6f440569ebc00052ef4e0317eeaa03998a359a501e5946b5903daf4229317b6ee688ee4deffb
-
SSDEEP
12288:NEdx8epMpDHeLp0ewAKOXCcfPHEl20/WAN9PuCCJQppO70an:NIdytHe1hFzfPHAxPa7b
Malware Config
Extracted
formbook
4.1
ges9
lolofestival.store
amzin.info
pulsahokii.xyz
bahiszirve.com
animekoe.com
kansastaxaccountant.net
howgoodisgod.online
medakaravan.xyz
pesmagazine.net
americanpopulist.info
nepalihandicraft.com
mariabakermodeling.com
cavify.top
onlinewoonboulevard.com
furniture-22830.com
ophthalmicpersonneltraining.us
yz1204.com
extrawhite.site
tomo.store
martfind.online
united-bc.com
hethonglikesub.site
goldenstategeneralstore.com
amazdea.com
emiliahernandez.com
weeklyrhino.buzz
erjcbtwg.work
16321.xyz
crainbramp.games
studiochiodi.info
km97.xyz
synertel.site
ankerbios.expert
chipetaresort.com
gakuj.xyz
simmonsguitars.com
povsearcher.com
salesatomizer.app
loopmart.shop
easyonionringrecipe.site
icss.studio
ksamayaiu.xyz
xn--recomindame-gbb.com
bepillow.com
homesinowensboro.com
abrashina.com
dplck.com
michellentherapy.com
voyance.health
zwcl365.com
akroglobal.com
endlessillumination.store
florediemgardens.com
lis-journal.com
justinrichert.net
baschung.swiss
thesexyviking.com
abickofconsulting.com
vivacious713833.com
dental-implants-52958.com
tigaberlian.net
trxtr.xyz
offficebanking-cl.top
huslnfts.xyz
viralcx.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4172-341-0x0000000010410000-0x000000001043F000-memory.dmp formbook behavioral2/memory/3772-366-0x0000000000790000-0x00000000007BF000-memory.dmp formbook behavioral2/memory/3772-371-0x0000000000790000-0x00000000007BF000-memory.dmp formbook -
ModiLoader Second Stage 62 IoCs
Processes:
resource yara_rule behavioral2/memory/4264-133-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-137-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-138-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-139-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-140-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-141-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-142-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-143-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-144-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-145-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-146-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-147-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-148-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-149-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-150-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-151-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-152-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-153-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-154-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-155-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-156-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-157-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-158-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-159-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-160-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-161-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-162-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-163-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-164-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-165-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-166-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-167-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-168-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-169-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-170-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-171-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-172-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-174-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-173-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-175-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-176-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-177-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-178-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-179-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-180-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-181-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-182-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-183-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-184-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-185-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-186-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-187-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-188-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-189-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-190-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-191-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-192-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-193-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-194-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-195-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-196-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 behavioral2/memory/4264-197-0x0000000003F90000-0x0000000003FC2000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ordine pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lwoysxqh = "C:\\Users\\Public\\Lwoysxqh.url" ordine pdf.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.execmd.exedescription pid process target process PID 4172 set thread context of 3176 4172 colorcpl.exe Explorer.EXE PID 3772 set thread context of 3176 3772 cmd.exe Explorer.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
ordine pdf.execolorcpl.execmd.exepid process 4264 ordine pdf.exe 4264 ordine pdf.exe 4172 colorcpl.exe 4172 colorcpl.exe 4172 colorcpl.exe 4172 colorcpl.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe 3772 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
colorcpl.execmd.exepid process 4172 colorcpl.exe 4172 colorcpl.exe 4172 colorcpl.exe 3772 cmd.exe 3772 cmd.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
colorcpl.exeExplorer.EXEcmd.exedescription pid process Token: SeDebugPrivilege 4172 colorcpl.exe Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeDebugPrivilege 3772 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ordine pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 4264 wrote to memory of 4172 4264 ordine pdf.exe colorcpl.exe PID 4264 wrote to memory of 4172 4264 ordine pdf.exe colorcpl.exe PID 4264 wrote to memory of 4172 4264 ordine pdf.exe colorcpl.exe PID 4264 wrote to memory of 4172 4264 ordine pdf.exe colorcpl.exe PID 4264 wrote to memory of 4172 4264 ordine pdf.exe colorcpl.exe PID 4264 wrote to memory of 4172 4264 ordine pdf.exe colorcpl.exe PID 3176 wrote to memory of 3772 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 3772 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 3772 3176 Explorer.EXE cmd.exe PID 3772 wrote to memory of 1952 3772 cmd.exe cmd.exe PID 3772 wrote to memory of 1952 3772 cmd.exe cmd.exe PID 3772 wrote to memory of 1952 3772 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ordine pdf.exe"C:\Users\Admin\AppData\Local\Temp\ordine pdf.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\colorcpl.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3176-347-0x0000000008480000-0x00000000085EA000-memory.dmpFilesize
1.4MB
-
memory/3176-377-0x0000000002F30000-0x0000000003005000-memory.dmpFilesize
852KB
-
memory/3176-374-0x0000000002F30000-0x0000000003005000-memory.dmpFilesize
852KB
-
memory/3772-371-0x0000000000790000-0x00000000007BF000-memory.dmpFilesize
188KB
-
memory/3772-370-0x0000000001170000-0x0000000001204000-memory.dmpFilesize
592KB
-
memory/3772-367-0x00000000013E0000-0x000000000172A000-memory.dmpFilesize
3.3MB
-
memory/3772-366-0x0000000000790000-0x00000000007BF000-memory.dmpFilesize
188KB
-
memory/3772-365-0x0000000000130000-0x000000000018A000-memory.dmpFilesize
360KB
-
memory/4172-339-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/4172-341-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4172-343-0x0000000004FD0000-0x000000000531A000-memory.dmpFilesize
3.3MB
-
memory/4172-345-0x0000000004F60000-0x0000000004F75000-memory.dmpFilesize
84KB
-
memory/4264-167-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-172-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-143-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-144-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-145-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-146-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-147-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-148-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-149-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-150-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-151-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-152-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-153-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-154-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-155-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-156-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-157-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-158-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-159-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-160-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-161-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-162-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-163-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-164-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-165-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-166-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-141-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-168-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-169-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-170-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-171-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-142-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-174-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-173-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-175-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-176-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-177-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-178-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-179-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-180-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-181-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-182-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-183-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-184-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-185-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-186-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-187-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-188-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-189-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-190-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-191-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-192-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-140-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-139-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-138-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-137-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-136-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/4264-135-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/4264-133-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-193-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-194-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-195-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-196-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB
-
memory/4264-197-0x0000000003F90000-0x0000000003FC2000-memory.dmpFilesize
200KB