Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 11:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe
-
Size
2.3MB
-
MD5
d5c2f96bdb737ed828f8585988cc5f39
-
SHA1
947b5680beea102d99f3425277d0b812aa28fd55
-
SHA256
8ede84109b78394b42ead5f872791601ccd8c52806ece2fbf30922f7d1694c83
-
SHA512
c94f4d6de14fb1db0c9ef33c1aa550ea6a03939fccbf99d9a1c49e775566f8041f321e7ea02ce8d266575580ad629fe11d2f5a18cf7d90077fa4ebee1735f44c
-
SSDEEP
49152:zmzOUMZYppNNWCsVb6KUpZ+hDg1F2d6bXkVaW4m/:UOU6YpB5SbWf+YFC8kVafe
Malware Config
Signatures
-
Detects executables packed with VMProtect. 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2280-53-0x0000000000810000-0x0000000000824000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2280-54-0x0000000000810000-0x0000000000824000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2280-91-0x0000000000810000-0x0000000000824000-memory.dmp INDICATOR_EXE_Packed_VMProtect -
UPX dump on OEP (original entry point) 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2280-0-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-1-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-2-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-15-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-21-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-19-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-17-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-23-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-5-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-3-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-7-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-34-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-9-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-41-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-44-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-39-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-37-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-35-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-31-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-29-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-27-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-25-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-13-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-11-0x0000000010000000-0x000000001003E000-memory.dmp UPX C:\Windows\SysWOW64\dm.dll UPX behavioral1/memory/2656-52-0x0000000010000000-0x0000000010176000-memory.dmp UPX behavioral1/memory/2280-53-0x0000000000810000-0x0000000000824000-memory.dmp UPX behavioral1/memory/2280-55-0x00000000032A0000-0x0000000003416000-memory.dmp UPX behavioral1/memory/2280-54-0x0000000000810000-0x0000000000824000-memory.dmp UPX behavioral1/memory/2280-77-0x00000000032A0000-0x0000000003416000-memory.dmp UPX behavioral1/memory/2280-82-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2280-91-0x0000000000810000-0x0000000000824000-memory.dmp UPX -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\dm.dll acprotect -
Processes:
resource yara_rule behavioral1/memory/2280-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-11-0x0000000010000000-0x000000001003E000-memory.dmp upx C:\Windows\SysWOW64\dm.dll upx behavioral1/memory/2656-52-0x0000000010000000-0x0000000010176000-memory.dmp upx behavioral1/memory/2280-53-0x0000000000810000-0x0000000000824000-memory.dmp upx behavioral1/memory/2280-55-0x00000000032A0000-0x0000000003416000-memory.dmp upx behavioral1/memory/2280-54-0x0000000000810000-0x0000000000824000-memory.dmp upx behavioral1/memory/2280-77-0x00000000032A0000-0x0000000003416000-memory.dmp upx behavioral1/memory/2280-82-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2280-91-0x0000000000810000-0x0000000000824000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription ioc process File opened for modification \??\PhysicalDrive0 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Drops file in System32 directory 2 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription ioc process File created C:\Windows\SysWOW64\dm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe File opened for modification C:\Windows\SysWOW64\dm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Drops file in Windows directory 2 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription ioc process File created C:\WINDOWS\Edm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe File opened for modification C:\WINDOWS\Edm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Modifies registry class 37 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32\ = "C:\\WINDOWS\\Edm.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID\ = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR\ = "C:\\WINDOWS\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\ = "dm.dmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer\ = "dm.dmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ = "dm.dmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ = "C:\\WINDOWS\\Edm.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID\ = "dm.dmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\ = "Dm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription pid process Token: SeDebugPrivilege 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe Token: SeDebugPrivilege 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exepid process 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription pid process target process PID 2280 wrote to memory of 2656 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 2280 wrote to memory of 2656 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 2280 wrote to memory of 2656 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 2280 wrote to memory of 2656 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 2280 wrote to memory of 2656 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 2280 wrote to memory of 2656 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 2280 wrote to memory of 2656 2280 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\WINDOWS\Edm.dll2⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\×¢²áÂëÅäÖÃ.iniFilesize
45B
MD5304d18e401d5041ebf4b41f6df6c67c5
SHA1d13ee90af0eddfd7b0d44c207bfd0b9422f7a8e0
SHA256c125cb2179dc17a1a9500fdb397516d6aa13cceb259c2664fc60356bfdcf00d3
SHA5129c91769d43be38c8e30f35f3d5c58c463f1c64958eaa89a7ee481e4bc2f76d22bb66d2c94e6d221579cf5fa23c23b12326f0c85633851c863b627268485a2ebb
-
C:\Windows\SysWOW64\dm.dllFilesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
-
memory/2280-31-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-19-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-21-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-29-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-17-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-27-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-5-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-3-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-7-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-34-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-9-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-44-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-37-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-96-0x0000000003240000-0x000000000324A000-memory.dmpFilesize
40KB
-
memory/2280-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-23-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-25-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-13-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-11-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-2-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-95-0x0000000003240000-0x000000000324A000-memory.dmpFilesize
40KB
-
memory/2280-53-0x0000000000810000-0x0000000000824000-memory.dmpFilesize
80KB
-
memory/2280-55-0x00000000032A0000-0x0000000003416000-memory.dmpFilesize
1.5MB
-
memory/2280-54-0x0000000000810000-0x0000000000824000-memory.dmpFilesize
80KB
-
memory/2280-57-0x0000000003240000-0x000000000324A000-memory.dmpFilesize
40KB
-
memory/2280-56-0x0000000003240000-0x000000000324A000-memory.dmpFilesize
40KB
-
memory/2280-1-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-77-0x00000000032A0000-0x0000000003416000-memory.dmpFilesize
1.5MB
-
memory/2280-82-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2280-91-0x0000000000810000-0x0000000000824000-memory.dmpFilesize
80KB
-
memory/2280-0-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2656-52-0x0000000010000000-0x0000000010176000-memory.dmpFilesize
1.5MB