Analysis
-
max time kernel
132s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe
Resource
win10v2004-20240508-en
General
-
Target
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe
-
Size
4.3MB
-
MD5
67cef2b94174d0883a8e8b9ad9c217c7
-
SHA1
d674a6454b03d5190ea685112e68a6604eabfc39
-
SHA256
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7
-
SHA512
bd335514641c23f96063c92783bcc2e607c7765705aafa2e742b631c102c08704b1bc77ba61dce7f2267abd5e0e4a30653a50179f86689ecf348f5eb0057ea3c
-
SSDEEP
49152:WgMCMqzvDxEHJKquC8nlPCx0jdt8not+bgZV014po/8QNT9Fr1:wGdlbInoM0bBO5H
Malware Config
Extracted
vidar
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Extracted
risepro
77.105.132.27:50500
Extracted
lumma
https://contintnetksows.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1756-67-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/1756-72-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/1756-73-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/1756-85-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral1/memory/1756-172-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
BGCBGCAFII.exeGIIIECBGDH.exeEBKEHJJDAA.exepid process 4456 BGCBGCAFII.exe 1932 GIIIECBGDH.exe 4776 EBKEHJJDAA.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exeBGCBGCAFII.exeEBKEHJJDAA.exeGIIIECBGDH.exedescription pid process target process PID 2168 set thread context of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 4456 set thread context of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4776 set thread context of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 1932 set thread context of 688 1932 GIIIECBGDH.exe RegAsm.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4328 4456 WerFault.exe BGCBGCAFII.exe 3216 4776 WerFault.exe EBKEHJJDAA.exe 2252 1932 WerFault.exe GIIIECBGDH.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2592 timeout.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MSBuild.exepid process 1756 MSBuild.exe 1756 MSBuild.exe 1756 MSBuild.exe 1756 MSBuild.exe 1756 MSBuild.exe 1756 MSBuild.exe 1756 MSBuild.exe 1756 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe Token: SeDebugPrivilege 4008 RegAsm.exe Token: SeBackupPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeBackupPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeBackupPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeBackupPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeBackupPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeBackupPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe Token: SeSecurityPrivilege 4008 RegAsm.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exeMSBuild.exeBGCBGCAFII.exeEBKEHJJDAA.execmd.exeGIIIECBGDH.exedescription pid process target process PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 2168 wrote to memory of 1756 2168 a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe MSBuild.exe PID 1756 wrote to memory of 4456 1756 MSBuild.exe BGCBGCAFII.exe PID 1756 wrote to memory of 4456 1756 MSBuild.exe BGCBGCAFII.exe PID 1756 wrote to memory of 4456 1756 MSBuild.exe BGCBGCAFII.exe PID 4456 wrote to memory of 4820 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4820 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4820 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 440 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 440 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 440 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 4456 wrote to memory of 4644 4456 BGCBGCAFII.exe RegAsm.exe PID 1756 wrote to memory of 1932 1756 MSBuild.exe GIIIECBGDH.exe PID 1756 wrote to memory of 1932 1756 MSBuild.exe GIIIECBGDH.exe PID 1756 wrote to memory of 1932 1756 MSBuild.exe GIIIECBGDH.exe PID 1756 wrote to memory of 4776 1756 MSBuild.exe EBKEHJJDAA.exe PID 1756 wrote to memory of 4776 1756 MSBuild.exe EBKEHJJDAA.exe PID 1756 wrote to memory of 4776 1756 MSBuild.exe EBKEHJJDAA.exe PID 4776 wrote to memory of 2324 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 2324 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 2324 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 4776 wrote to memory of 4008 4776 EBKEHJJDAA.exe RegAsm.exe PID 1756 wrote to memory of 4440 1756 MSBuild.exe cmd.exe PID 1756 wrote to memory of 4440 1756 MSBuild.exe cmd.exe PID 1756 wrote to memory of 4440 1756 MSBuild.exe cmd.exe PID 4440 wrote to memory of 2592 4440 cmd.exe timeout.exe PID 4440 wrote to memory of 2592 4440 cmd.exe timeout.exe PID 4440 wrote to memory of 2592 4440 cmd.exe timeout.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe PID 1932 wrote to memory of 688 1932 GIIIECBGDH.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe"C:\Users\Admin\AppData\Local\Temp\a928fc7218f8b916a6c386f500634dc2f31772ed5da82173b257ccf4371bdee7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BGCBGCAFII.exe"C:\ProgramData\BGCBGCAFII.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 3084⤵
- Program crash
-
C:\ProgramData\GIIIECBGDH.exe"C:\ProgramData\GIIIECBGDH.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 3284⤵
- Program crash
-
C:\ProgramData\EBKEHJJDAA.exe"C:\ProgramData\EBKEHJJDAA.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 3084⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBFIIEHJDBKJ" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4456 -ip 44561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4776 -ip 47761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1932 -ip 19321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\BGCBGCAFII.exeFilesize
1.8MB
MD5785a4d0ce6dee4c3bccd020a9d1b5ed9
SHA19d610511936fd60e388f344729c06a2db7479ade
SHA256f5093c69b58ce1149d43a7ec268eba733115429e26ca23820571306571b31ead
SHA5121fe0c987530a8183a0789f799bd949b1f8b2fb25bfc6110521dac5b68306f8e9c8028a952c9430b96a082c701760eade51a3112d9b8b04bf77f4c356d19d0f51
-
C:\ProgramData\EBKEHJJDAA.exeFilesize
643KB
MD5f03f43046831d8eee22e959770aaedf1
SHA13e63791066428f782286f4180f82631240326344
SHA25604dbcbb46b56d4bff31ca8b58d398a90bca5f523a3ba6b8c7300e4ee19c54124
SHA512128e942b7a1778385866e8ab336ef778d7e6248b037345c0d36dd8e8329ea7952956dc7ed30ee4af58fe22a319f26c28f7062916a07a4dcd3930d854cfc6f57e
-
C:\ProgramData\GIIIECBGDH.exeFilesize
520KB
MD53900de86228c8f839d6d4b483794457b
SHA190e24676fd3ebcda8635704e762e83d3fbd9cfba
SHA25600c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3
SHA5125bd0c7f623a6a3c11091391c72868c4462525618164d40a28a19dc5913766b7ebb2878206b4077a7374de23562343748e27e4594ad5c56434fb9fff40e91f4dc
-
memory/1756-67-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1756-72-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1756-73-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1756-85-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/1756-172-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/2168-24-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-12-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-5-0x0000000005AA0000-0x0000000005BAC000-memory.dmpFilesize
1.0MB
-
memory/2168-6-0x00000000059F0000-0x0000000005A0C000-memory.dmpFilesize
112KB
-
memory/2168-14-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-66-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-62-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-71-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/2168-70-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/2168-60-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-50-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-48-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-46-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-44-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-40-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-38-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-36-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-34-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-32-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-30-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-28-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-26-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-3-0x0000000005890000-0x000000000589A000-memory.dmpFilesize
40KB
-
memory/2168-22-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-18-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-4-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/2168-10-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-7-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-64-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-58-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-56-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-54-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-52-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-42-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-20-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-17-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-8-0x00000000059F0000-0x0000000005A05000-memory.dmpFilesize
84KB
-
memory/2168-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmpFilesize
4KB
-
memory/2168-1-0x0000000000AE0000-0x0000000000F32000-memory.dmpFilesize
4.3MB
-
memory/2168-2-0x0000000005950000-0x00000000059EC000-memory.dmpFilesize
624KB
-
memory/4008-166-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4008-167-0x0000000005400000-0x00000000059A4000-memory.dmpFilesize
5.6MB
-
memory/4008-168-0x0000000004EF0000-0x0000000004F82000-memory.dmpFilesize
584KB
-
memory/4008-169-0x0000000005090000-0x000000000509A000-memory.dmpFilesize
40KB
-
memory/4008-173-0x0000000008130000-0x0000000008748000-memory.dmpFilesize
6.1MB
-
memory/4008-175-0x0000000007CF0000-0x0000000007D02000-memory.dmpFilesize
72KB
-
memory/4008-174-0x0000000007DA0000-0x0000000007EAA000-memory.dmpFilesize
1.0MB
-
memory/4008-176-0x0000000007D50000-0x0000000007D8C000-memory.dmpFilesize
240KB
-
memory/4008-177-0x0000000007EB0000-0x0000000007EFC000-memory.dmpFilesize
304KB
-
memory/4456-141-0x00000000025E0000-0x00000000025E1000-memory.dmpFilesize
4KB
-
memory/4644-146-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/4644-178-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB