Analysis
-
max time kernel
151s -
max time network
120s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-05-2021 04:12
Static task
static1
Behavioral task
behavioral1
Sample
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe
Resource
win10v20210410
General
-
Target
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe
-
Size
759KB
-
MD5
0975db5051a34591560f66e6f267bcda
-
SHA1
1aa2b239eac5cbd19950b2a4afc8d41833d3f3e1
-
SHA256
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d
-
SHA512
44246fdb3b70202218625a3503df8d0a954014edd6f2ca78ffe9636c9b7d20ab0cddb9576fb0b6c0ffc94f025566cb8d14285427dfec906daf1d823f0ceede15
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exeexplorer.exedescription pid process target process PID 484 set thread context of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 1948 set thread context of 1740 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe explorer.exe PID 1740 set thread context of 1412 1740 explorer.exe explorer.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exeexplorer.exedescription pid process Token: SeIncreaseQuotaPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeSecurityPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeTakeOwnershipPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeLoadDriverPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeSystemProfilePrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeSystemtimePrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeProfSingleProcessPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeIncBasePriorityPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeCreatePagefilePrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeBackupPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeRestorePrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeShutdownPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeDebugPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeSystemEnvironmentPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeChangeNotifyPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeRemoteShutdownPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeUndockPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeManageVolumePrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeImpersonatePrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeCreateGlobalPrivilege 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: 33 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: 34 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: 35 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe Token: SeIncreaseQuotaPrivilege 1412 explorer.exe Token: SeSecurityPrivilege 1412 explorer.exe Token: SeTakeOwnershipPrivilege 1412 explorer.exe Token: SeLoadDriverPrivilege 1412 explorer.exe Token: SeSystemProfilePrivilege 1412 explorer.exe Token: SeSystemtimePrivilege 1412 explorer.exe Token: SeProfSingleProcessPrivilege 1412 explorer.exe Token: SeIncBasePriorityPrivilege 1412 explorer.exe Token: SeCreatePagefilePrivilege 1412 explorer.exe Token: SeBackupPrivilege 1412 explorer.exe Token: SeRestorePrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeDebugPrivilege 1412 explorer.exe Token: SeSystemEnvironmentPrivilege 1412 explorer.exe Token: SeChangeNotifyPrivilege 1412 explorer.exe Token: SeRemoteShutdownPrivilege 1412 explorer.exe Token: SeUndockPrivilege 1412 explorer.exe Token: SeManageVolumePrivilege 1412 explorer.exe Token: SeImpersonatePrivilege 1412 explorer.exe Token: SeCreateGlobalPrivilege 1412 explorer.exe Token: 33 1412 explorer.exe Token: 34 1412 explorer.exe Token: 35 1412 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 1412 explorer.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exeexplorer.exedescription pid process target process PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 484 wrote to memory of 1948 484 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1720 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe notepad.exe PID 1948 wrote to memory of 1740 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe explorer.exe PID 1948 wrote to memory of 1740 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe explorer.exe PID 1948 wrote to memory of 1740 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe explorer.exe PID 1948 wrote to memory of 1740 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe explorer.exe PID 1948 wrote to memory of 1740 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe explorer.exe PID 1948 wrote to memory of 1740 1948 08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe PID 1740 wrote to memory of 1412 1740 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe"C:\Users\Admin\AppData\Local\Temp\08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe"C:\Users\Admin\AppData\Local\Temp\08738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windupdt\winupdate.exeMD5
0975db5051a34591560f66e6f267bcda
SHA11aa2b239eac5cbd19950b2a4afc8d41833d3f3e1
SHA25608738f3c54f1746671a177e6b62f888168b1c6a6cc8bc33465ba7bd561e43d5d
SHA51244246fdb3b70202218625a3503df8d0a954014edd6f2ca78ffe9636c9b7d20ab0cddb9576fb0b6c0ffc94f025566cb8d14285427dfec906daf1d823f0ceede15
-
memory/1412-76-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1412-75-0x0000000013140000-0x00000000131F6000-memory.dmpFilesize
728KB
-
memory/1412-73-0x00000000131D08B4-mapping.dmp
-
memory/1720-70-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1720-63-0x0000000000000000-mapping.dmp
-
memory/1740-66-0x000000000040676E-mapping.dmp
-
memory/1740-65-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1740-71-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1948-67-0x0000000013140000-0x00000000131F6000-memory.dmpFilesize
728KB
-
memory/1948-60-0x0000000013140000-0x00000000131F6000-memory.dmpFilesize
728KB
-
memory/1948-68-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1948-62-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1948-61-0x00000000131D08B4-mapping.dmp