Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-10-2021 05:22
Static task
static1
Behavioral task
behavioral1
Sample
47c116db3f0e5d536352aaecbbc7d6b6.exe
Resource
win7-en-20210920
General
-
Target
47c116db3f0e5d536352aaecbbc7d6b6.exe
-
Size
149KB
-
MD5
47c116db3f0e5d536352aaecbbc7d6b6
-
SHA1
9aab8a86b946ba6eaf513206e1c594fda27ae646
-
SHA256
bd5f19d54c0d5de713d609653e64116e07af8037a322f803850c9cb1e6a03c90
-
SHA512
82d6325993b4bbddf1c1db66d47de0430ad67338303708889fe0914aec6259579501c5b5ca0ad8cd18262d8a722f327ded0ad62a8c4559b8293cfaee3ab03aad
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
47c116db3f0e5d536352aaecbbc7d6b6Srv.exeDesktopLayer.exepid process 1108 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe 1184 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6Srv.exe upx behavioral2/memory/1108-117-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6Srv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx -
Drops file in Program Files directory 3 IoCs
Processes:
47c116db3f0e5d536352aaecbbc7d6b6Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px8920.tmp 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
47c116db3f0e5d536352aaecbbc7d6b6.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 47c116db3f0e5d536352aaecbbc7d6b6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 47c116db3f0e5d536352aaecbbc7d6b6.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340200101" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3380936730" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30915001" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3397812819" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30915001" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4D64F76-25AC-11EC-B2DB-56DFFBC7AD00} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30915001" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3380936730" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340232093" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340183507" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
DesktopLayer.exe47c116db3f0e5d536352aaecbbc7d6b6.exepid process 1184 DesktopLayer.exe 1184 DesktopLayer.exe 1184 DesktopLayer.exe 1184 DesktopLayer.exe 1184 DesktopLayer.exe 1184 DesktopLayer.exe 1184 DesktopLayer.exe 1184 DesktopLayer.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 904 47c116db3f0e5d536352aaecbbc7d6b6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1380 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1380 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1380 iexplore.exe 1380 iexplore.exe 1760 IEXPLORE.EXE 1760 IEXPLORE.EXE 1760 IEXPLORE.EXE 1760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
47c116db3f0e5d536352aaecbbc7d6b6.exe47c116db3f0e5d536352aaecbbc7d6b6Srv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 904 wrote to memory of 1108 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe PID 904 wrote to memory of 1108 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe PID 904 wrote to memory of 1108 904 47c116db3f0e5d536352aaecbbc7d6b6.exe 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe PID 1108 wrote to memory of 1184 1108 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe DesktopLayer.exe PID 1108 wrote to memory of 1184 1108 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe DesktopLayer.exe PID 1108 wrote to memory of 1184 1108 47c116db3f0e5d536352aaecbbc7d6b6Srv.exe DesktopLayer.exe PID 1184 wrote to memory of 1380 1184 DesktopLayer.exe iexplore.exe PID 1184 wrote to memory of 1380 1184 DesktopLayer.exe iexplore.exe PID 1380 wrote to memory of 1760 1380 iexplore.exe IEXPLORE.EXE PID 1380 wrote to memory of 1760 1380 iexplore.exe IEXPLORE.EXE PID 1380 wrote to memory of 1760 1380 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6.exe"C:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6Srv.exeC:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1380 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
46cbd0a3d1e70a49db77aa1a79dea093
SHA1e7ee6492153fcb7477c0512e14e923532940e066
SHA256678c0747c7616857ed9abc64fa182ae2ff649167f322a11299b1119947f2f651
SHA5128e11310cb6ea27c0aed73c29293fc3336e5445391063bc7e5a8b0443784a5a9919786386d950bdfe6f4e9cefb83f44a0ebeb400ddb1ed2ced0e16274f691784b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
2d127a1af96a5c9b55e28ac3b43b0e79
SHA11245d08e057ad035317640280effeac779add9bd
SHA25673784b6b19b6b6f7f1d8f494bc1588843225934c23c21c17a63a458123f69459
SHA512591418995b0847d1a7e14afbae0b986ade080de00297f1e48c3f3c426ebe1b59c35cbd5befb59e8c3da92ddedf5cc3b43c59f0cae8a96a62cade88b1295854ad
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\42ZEFEYY.cookieMD5
0fb277f2a4342da9e3088221773aa1b7
SHA1e90686c4d2bab46f027fb16f6f5238a27e1907c4
SHA256ad27c11e6f1d4b43bdc77db083b5f2c473d6c5c69df55e24cd06de358e336a29
SHA512f3b9c9413bca2f668c3af2bb22ce1eec30c0184c066c36f82cbd4c51cc32fd7cea0f1179f46b6c388b632c854fdb9a51d7297e4b43dd8f83aa775e12b4aa881a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\OJQ4F9VC.cookieMD5
5e74b61baa2daef94228903e54d69e49
SHA11a5e6debc1ce288b2cabab9a806f3712f773dcba
SHA256cc1ae18754d6d677b006e425ae52ba0cc25cc552640ae703c5741472abb3c3ec
SHA512a905a6e34590ca3d614447a4c172e0fd31d29ec44b87a35017d9a290c9237fa2c2b72c46baf2fa999d3670c5ba6bd50ec6507add57bd040b3276c5d8d3272ffe
-
C:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6Srv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\47c116db3f0e5d536352aaecbbc7d6b6Srv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/904-119-0x0000000010000000-0x000000001000A000-memory.dmpFilesize
40KB
-
memory/1108-114-0x0000000000000000-mapping.dmp
-
memory/1108-116-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/1108-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1184-121-0x0000000000000000-mapping.dmp
-
memory/1184-124-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/1380-125-0x0000000000000000-mapping.dmp
-
memory/1380-126-0x00007FFAEEB30000-0x00007FFAEEB9B000-memory.dmpFilesize
428KB
-
memory/1760-127-0x0000000000000000-mapping.dmp