Analysis
-
max time kernel
142s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-05-2021 04:12
Static task
static1
Behavioral task
behavioral1
Sample
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe
Resource
win7v20210410
General
-
Target
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe
-
Size
464KB
-
MD5
15c55b525bf6ac3bd679992319d442e9
-
SHA1
a8af7037200fa0091c65a916e6f53c8690d66ba4
-
SHA256
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e
-
SHA512
a6a4af276863c48ab754b649cc590682b46809899c92b7eda1a3ae4d8d7dfd8ad47ff1e2062dd53b8e23db807b0de5c04b59969912bc5317c78919292a07b7fc
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeDesktopLayer.exepid process 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 1992 DesktopLayer.exe -
Processes:
resource yara_rule behavioral1/memory/2044-83-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Loads dropped DLL 10 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeDesktopLayer.exepid process 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 1992 DesktopLayer.exe 1992 DesktopLayer.exe 1992 DesktopLayer.exe -
Drops file in Program Files directory 3 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px1729.tmp 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44CDBC21-B55B-11EB-BE93-726C7BD0CD11} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327833895" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
DesktopLayer.exepid process 1992 DesktopLayer.exe 1992 DesktopLayer.exe 1992 DesktopLayer.exe 1992 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1948 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1948 iexplore.exe 1948 iexplore.exe 872 IEXPLORE.EXE 872 IEXPLORE.EXE 872 IEXPLORE.EXE 872 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeDesktopLayer.exepid process 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 1992 DesktopLayer.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 1208 wrote to memory of 2044 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 1208 wrote to memory of 2044 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 1208 wrote to memory of 2044 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 1208 wrote to memory of 2044 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 1208 wrote to memory of 2044 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 1208 wrote to memory of 2044 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 1208 wrote to memory of 2044 1208 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 2044 wrote to memory of 1992 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 2044 wrote to memory of 1992 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 2044 wrote to memory of 1992 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 2044 wrote to memory of 1992 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 2044 wrote to memory of 1992 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 2044 wrote to memory of 1992 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 2044 wrote to memory of 1992 2044 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 1992 wrote to memory of 1948 1992 DesktopLayer.exe iexplore.exe PID 1992 wrote to memory of 1948 1992 DesktopLayer.exe iexplore.exe PID 1992 wrote to memory of 1948 1992 DesktopLayer.exe iexplore.exe PID 1992 wrote to memory of 1948 1992 DesktopLayer.exe iexplore.exe PID 1948 wrote to memory of 872 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 872 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 872 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 872 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 872 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 872 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 872 1948 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe"C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeC:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XX2HDKJH.txtMD5
0f1b992ee6f6a01fcd22e90a3858bb8e
SHA15b2b3a10cb14829ab1cb8895e33f78458fcbad88
SHA256f212dda24dcbd1a5568af90f0e89fe427de59160e37cc350421076ded6134057
SHA512e74f17ccdc62caf4c5e3878cc2cdcb0d3ded5c9ca25556768f0b17dbfa31251c20f06585665b88f1861dc0e98d516c1262c591953ed989366cdf69231a7f7b80
-
\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
memory/872-80-0x0000000000000000-mapping.dmp
-
memory/1208-59-0x0000000075561000-0x0000000075563000-memory.dmpFilesize
8KB
-
memory/1948-79-0x0000000000000000-mapping.dmp
-
memory/1948-86-0x00000000041D0000-0x00000000041D1000-memory.dmpFilesize
4KB
-
memory/1992-71-0x0000000000000000-mapping.dmp
-
memory/1992-78-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2044-83-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2044-82-0x0000000000440000-0x0000000000442000-memory.dmpFilesize
8KB
-
memory/2044-62-0x0000000000000000-mapping.dmp