Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 14:33
Static task
static1
Behavioral task
behavioral1
Sample
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe
Resource
win10v2004-20240426-en
General
-
Target
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe
-
Size
4.0MB
-
MD5
423a60edff840e9fe38ec71100707478
-
SHA1
8d5432a241847e90a5aa3a2ab99918d56ae2b4b2
-
SHA256
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953
-
SHA512
db20925bff79c38b3862a68352ef6af1fdeba17aa533959debc4423da18249d290f8a4361325f6df654bc3c953be396df44909a02e04d4ecdaf07b2ee10bb28f
-
SSDEEP
98304:v2SVMD8Lnsmtk2aX3Ob9lG4TLaeOnTPia:/NLfdLzOz
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240613703.bat family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
look2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240613703.bat" look2.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeSynaptics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 6 IoCs
Processes:
look2.exeHD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeSynaptics.exe._cache_Synaptics.exesvchcst.exepid process 232 look2.exe 3800 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2624 Synaptics.exe 4256 ._cache_Synaptics.exe 4364 svchcst.exe -
Loads dropped DLL 3 IoCs
Processes:
look2.exesvchost.exesvchcst.exepid process 232 look2.exe 3308 svchost.exe 4364 svchcst.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe -
Drops file in System32 directory 4 IoCs
Processes:
svchost.exelook2.exedescription ioc process File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\240613703.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeSynaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exepid process 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_Synaptics.exepid process 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 740 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 4256 ._cache_Synaptics.exe 4256 ._cache_Synaptics.exe 4256 ._cache_Synaptics.exe 4256 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeHD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeSynaptics.exesvchost.exedescription pid process target process PID 4064 wrote to memory of 232 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe look2.exe PID 4064 wrote to memory of 232 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe look2.exe PID 4064 wrote to memory of 232 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe look2.exe PID 4064 wrote to memory of 3800 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 4064 wrote to memory of 3800 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 4064 wrote to memory of 3800 4064 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 3800 wrote to memory of 740 3800 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 3800 wrote to memory of 740 3800 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 3800 wrote to memory of 740 3800 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 3800 wrote to memory of 2624 3800 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Synaptics.exe PID 3800 wrote to memory of 2624 3800 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Synaptics.exe PID 3800 wrote to memory of 2624 3800 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Synaptics.exe PID 2624 wrote to memory of 4256 2624 Synaptics.exe ._cache_Synaptics.exe PID 2624 wrote to memory of 4256 2624 Synaptics.exe ._cache_Synaptics.exe PID 2624 wrote to memory of 4256 2624 Synaptics.exe ._cache_Synaptics.exe PID 3308 wrote to memory of 4364 3308 svchost.exe svchcst.exe PID 3308 wrote to memory of 4364 3308 svchost.exe svchcst.exe PID 3308 wrote to memory of 4364 3308 svchost.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"C:\Users\Admin\AppData\Local\Temp\0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeC:\Users\Admin\AppData\Local\Temp\HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240613703.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeFilesize
2.1MB
MD580a19f81da0f52108a5ca011314891a9
SHA1e02c8614c63e7d6bb1778eb2fd1902b63e6ee2b0
SHA256a4ea9a60b2a8d49dcd084aaa70992c3d6fb32f97f131ecdbdd05bfb027b67596
SHA512984ead0d2c53cdddaab913eeedc2238c6d3f61f79be4321f9aa53dec6ba23588bbdb8180249f26430445db339557b47eb55321d551c50fe6be7426ce6f151ed7
-
C:\Users\Admin\AppData\Local\Temp\HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeFilesize
2.8MB
MD5390291a5e9a54e79b0d0f7aae99df9b5
SHA17744d645636441a0731b9f1342970319012a22ce
SHA256ae64f6d9a0080839eee44b702efb798ae5c28fdcb44af39c9595847d33846049
SHA512f760d69075c3ea393880f177cb43ddb23126eed34c7527ad49679f91190219ed89b40907b62c320bc147af95f029616d1b4d1311d40915322326105a30755cbe
-
C:\Users\Admin\AppData\Local\Temp\look2.exeFilesize
337KB
MD52f3b6f16e33e28ad75f3fdaef2567807
SHA185e907340faf1edfc9210db85a04abd43d21b741
SHA25686492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
SHA512db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
-
C:\Windows\SysWOW64\240613703.batFilesize
51KB
MD5ace7e50c7492107e98a124e102b87e81
SHA1b39e067be1f9d8caa983c566c4d9b934cea24f38
SHA25610b0460d318cc478d62d3167cbb8a3bb85d9ada0c64cbe89cd679ad5e8c08f33
SHA512bc0c30fe005994b89f2581e8c9576c91e130fd5094dd76b0c2701863b23b7b207946b3cfbd8690accc2ea68646fa0cd4bfcaf10028c068ed1888ce1bd87f5803
-
C:\Windows\SysWOW64\svchcst.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/2624-212-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB
-
memory/2624-218-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB
-
memory/2624-237-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB
-
memory/3800-18-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/3800-146-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB