Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-06-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe
Resource
win10v2004-20240508-en
General
-
Target
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe
-
Size
4.7MB
-
MD5
6320d63025e1764e578680e24906def3
-
SHA1
b452cb8f5fe2b5683b8ea94b90c5d3f415e53832
-
SHA256
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0
-
SHA512
f75d2700fafea373de7f2c4131a650128d38146ef8fd7edef0c186ce3ebc1fb51b116f91596891d68f893a56b30e14035e565a55d0e5d228462c9e3e7a68dc51
-
SSDEEP
98304:KjG9asZlqf3mTJBMAxu8l+yzWCdlPtclKfWN6D:KjGgsZlqvmT8wu8lZWCzo+
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Extracted
risepro
77.105.132.27:50500
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3100-69-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3100-72-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3100-67-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3100-86-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/3100-173-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
EBGDAAKJJD.exeCBAKJEHDBG.exeGDAAKKEHDH.exepid process 2928 EBGDAAKJJD.exe 4476 CBAKJEHDBG.exe 2124 GDAAKKEHDH.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exeEBGDAAKJJD.exeGDAAKKEHDH.exeCBAKJEHDBG.exedescription pid process target process PID 3220 set thread context of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 2928 set thread context of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2124 set thread context of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 4476 set thread context of 3688 4476 CBAKJEHDBG.exe RegAsm.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4660 2928 WerFault.exe EBGDAAKJJD.exe 4888 2124 WerFault.exe GDAAKKEHDH.exe 3232 4476 WerFault.exe CBAKJEHDBG.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1964 timeout.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MSBuild.exepid process 3100 MSBuild.exe 3100 MSBuild.exe 3100 MSBuild.exe 3100 MSBuild.exe 3100 MSBuild.exe 3100 MSBuild.exe 3100 MSBuild.exe 3100 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe Token: SeDebugPrivilege 4732 RegAsm.exe Token: SeBackupPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeBackupPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeBackupPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeBackupPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeBackupPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeBackupPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe Token: SeSecurityPrivilege 4732 RegAsm.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exeMSBuild.exeEBGDAAKJJD.exeGDAAKKEHDH.execmd.exeCBAKJEHDBG.exedescription pid process target process PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3220 wrote to memory of 3100 3220 d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe MSBuild.exe PID 3100 wrote to memory of 2928 3100 MSBuild.exe EBGDAAKJJD.exe PID 3100 wrote to memory of 2928 3100 MSBuild.exe EBGDAAKJJD.exe PID 3100 wrote to memory of 2928 3100 MSBuild.exe EBGDAAKJJD.exe PID 2928 wrote to memory of 992 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 992 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 992 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 2928 wrote to memory of 1780 2928 EBGDAAKJJD.exe RegAsm.exe PID 3100 wrote to memory of 4476 3100 MSBuild.exe CBAKJEHDBG.exe PID 3100 wrote to memory of 4476 3100 MSBuild.exe CBAKJEHDBG.exe PID 3100 wrote to memory of 4476 3100 MSBuild.exe CBAKJEHDBG.exe PID 3100 wrote to memory of 2124 3100 MSBuild.exe GDAAKKEHDH.exe PID 3100 wrote to memory of 2124 3100 MSBuild.exe GDAAKKEHDH.exe PID 3100 wrote to memory of 2124 3100 MSBuild.exe GDAAKKEHDH.exe PID 2124 wrote to memory of 4784 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4784 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4784 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 2124 wrote to memory of 4732 2124 GDAAKKEHDH.exe RegAsm.exe PID 3100 wrote to memory of 1860 3100 MSBuild.exe cmd.exe PID 3100 wrote to memory of 1860 3100 MSBuild.exe cmd.exe PID 3100 wrote to memory of 1860 3100 MSBuild.exe cmd.exe PID 1860 wrote to memory of 1964 1860 cmd.exe timeout.exe PID 1860 wrote to memory of 1964 1860 cmd.exe timeout.exe PID 1860 wrote to memory of 1964 1860 cmd.exe timeout.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe PID 4476 wrote to memory of 3688 4476 CBAKJEHDBG.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe"C:\Users\Admin\AppData\Local\Temp\d4b22461e379bba07e2e2f6cf1833884c0ff656b84afdd3b2284be856f598ae0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EBGDAAKJJD.exe"C:\ProgramData\EBGDAAKJJD.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 3324⤵
- Program crash
-
C:\ProgramData\CBAKJEHDBG.exe"C:\ProgramData\CBAKJEHDBG.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 3404⤵
- Program crash
-
C:\ProgramData\GDAAKKEHDH.exe"C:\ProgramData\GDAAKKEHDH.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 3204⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AKKEHIECFCAA" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2928 -ip 29281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2124 -ip 21241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4476 -ip 44761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\CBAKJEHDBG.exeFilesize
520KB
MD53900de86228c8f839d6d4b483794457b
SHA190e24676fd3ebcda8635704e762e83d3fbd9cfba
SHA25600c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3
SHA5125bd0c7f623a6a3c11091391c72868c4462525618164d40a28a19dc5913766b7ebb2878206b4077a7374de23562343748e27e4594ad5c56434fb9fff40e91f4dc
-
C:\ProgramData\EBGDAAKJJD.exeFilesize
1.8MB
MD5785a4d0ce6dee4c3bccd020a9d1b5ed9
SHA19d610511936fd60e388f344729c06a2db7479ade
SHA256f5093c69b58ce1149d43a7ec268eba733115429e26ca23820571306571b31ead
SHA5121fe0c987530a8183a0789f799bd949b1f8b2fb25bfc6110521dac5b68306f8e9c8028a952c9430b96a082c701760eade51a3112d9b8b04bf77f4c356d19d0f51
-
C:\ProgramData\GDAAKKEHDH.exeFilesize
643KB
MD5f03f43046831d8eee22e959770aaedf1
SHA13e63791066428f782286f4180f82631240326344
SHA25604dbcbb46b56d4bff31ca8b58d398a90bca5f523a3ba6b8c7300e4ee19c54124
SHA512128e942b7a1778385866e8ab336ef778d7e6248b037345c0d36dd8e8329ea7952956dc7ed30ee4af58fe22a319f26c28f7062916a07a4dcd3930d854cfc6f57e
-
memory/1780-179-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/1780-147-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/2928-143-0x00000000012D0000-0x00000000012D1000-memory.dmpFilesize
4KB
-
memory/3100-86-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/3100-69-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/3100-173-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/3100-67-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/3100-72-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/3220-3-0x0000000005930000-0x000000000593A000-memory.dmpFilesize
40KB
-
memory/3220-20-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-71-0x0000000074580000-0x0000000074D31000-memory.dmpFilesize
7.7MB
-
memory/3220-64-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-66-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-60-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-58-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-56-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-54-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-50-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-49-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-46-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-44-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-42-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-1-0x0000000000A70000-0x0000000000F2C000-memory.dmpFilesize
4.7MB
-
memory/3220-38-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-36-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-34-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-32-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-24-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-27-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-28-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-40-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-62-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-6-0x00000000059A0000-0x00000000059BC000-memory.dmpFilesize
112KB
-
memory/3220-16-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-12-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-11-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-8-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-52-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-30-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-0-0x000000007458E000-0x000000007458F000-memory.dmpFilesize
4KB
-
memory/3220-18-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-5-0x0000000005C80000-0x0000000005DF4000-memory.dmpFilesize
1.5MB
-
memory/3220-4-0x0000000074580000-0x0000000074D31000-memory.dmpFilesize
7.7MB
-
memory/3220-7-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-2-0x0000000005AE0000-0x0000000005B7C000-memory.dmpFilesize
624KB
-
memory/3220-22-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/3220-15-0x00000000059A0000-0x00000000059B5000-memory.dmpFilesize
84KB
-
memory/4732-169-0x00000000056A0000-0x0000000005732000-memory.dmpFilesize
584KB
-
memory/4732-170-0x0000000005610000-0x000000000561A000-memory.dmpFilesize
40KB
-
memory/4732-168-0x0000000005C50000-0x00000000061F6000-memory.dmpFilesize
5.6MB
-
memory/4732-174-0x00000000088B0000-0x0000000008EC8000-memory.dmpFilesize
6.1MB
-
memory/4732-175-0x0000000008400000-0x000000000850A000-memory.dmpFilesize
1.0MB
-
memory/4732-176-0x0000000008350000-0x0000000008362000-memory.dmpFilesize
72KB
-
memory/4732-167-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4732-178-0x0000000008510000-0x000000000855C000-memory.dmpFilesize
304KB
-
memory/4732-177-0x00000000083B0000-0x00000000083EC000-memory.dmpFilesize
240KB