Analysis
-
max time kernel
26s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 14:00
Static task
static1
Behavioral task
behavioral1
Sample
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe
Resource
win10v2004-20220414-en
General
-
Target
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe
-
Size
7.4MB
-
MD5
7a0f69ced2a8a66b3132d6c38613a8e3
-
SHA1
34c9a1895103b2825211d5819abdf168a72a7b68
-
SHA256
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05
-
SHA512
e111145f4c9b7144936d0a43e1e485d2132eaee19b3975a2a00e5c1eb930cdb01385d8d8073bf172ce60dc5cbcf5f11766b6bb62957c337bf3ba2598249e11a9
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
ComInfo.dllShowDrive.dl_ShowEFI.dl_Getptw.dllpid process 2024 ComInfo.dll 564 ShowDrive.dl_ 1188 ShowEFI.dl_ 1028 Getptw.dll -
Loads dropped DLL 8 IoCs
Processes:
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.execmd.execmd.execmd.exepid process 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1988 cmd.exe 1988 cmd.exe 1720 cmd.exe 1720 cmd.exe 1004 cmd.exe 1004 cmd.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exeShowDrive.dl_description ioc process File opened (read-only) \??\f: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\k: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\o: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\q: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\w: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\y: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\t: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\v: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\j: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\l: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\m: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\n: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\p: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\r: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\x: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\D: ShowDrive.dl_ File opened (read-only) \??\e: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\g: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\i: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\a: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\b: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\h: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\s: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\u: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe File opened (read-only) \??\z: 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ComInfo.dllShowEFI.dl_Getptw.dlldescription ioc process File opened for modification \??\PhysicalDrive0 ComInfo.dll File opened for modification \??\PhysicalDrive0 ShowEFI.dl_ File opened for modification \??\PhysicalDrive0 Getptw.dll -
NTFS ADS 1 IoCs
Processes:
ComInfo.dlldescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 ComInfo.dll -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Getptw.dll962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exepid process 1028 Getptw.dll 1028 Getptw.dll 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exeComInfo.dllpid process 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 2024 ComInfo.dll 2024 ComInfo.dll 2024 ComInfo.dll 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exeComInfo.dllpid process 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 2024 ComInfo.dll 2024 ComInfo.dll 2024 ComInfo.dll 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.execmd.execmd.execmd.exedescription pid process target process PID 1944 wrote to memory of 2024 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe ComInfo.dll PID 1944 wrote to memory of 2024 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe ComInfo.dll PID 1944 wrote to memory of 2024 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe ComInfo.dll PID 1944 wrote to memory of 2024 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe ComInfo.dll PID 1944 wrote to memory of 1988 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1988 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1988 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1988 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1988 wrote to memory of 564 1988 cmd.exe ShowDrive.dl_ PID 1988 wrote to memory of 564 1988 cmd.exe ShowDrive.dl_ PID 1988 wrote to memory of 564 1988 cmd.exe ShowDrive.dl_ PID 1988 wrote to memory of 564 1988 cmd.exe ShowDrive.dl_ PID 1944 wrote to memory of 1720 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1720 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1720 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1720 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1720 wrote to memory of 1188 1720 cmd.exe ShowEFI.dl_ PID 1720 wrote to memory of 1188 1720 cmd.exe ShowEFI.dl_ PID 1720 wrote to memory of 1188 1720 cmd.exe ShowEFI.dl_ PID 1720 wrote to memory of 1188 1720 cmd.exe ShowEFI.dl_ PID 1944 wrote to memory of 1004 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1004 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1004 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1944 wrote to memory of 1004 1944 962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe cmd.exe PID 1004 wrote to memory of 1028 1004 cmd.exe Getptw.dll PID 1004 wrote to memory of 1028 1004 cmd.exe Getptw.dll PID 1004 wrote to memory of 1028 1004 cmd.exe Getptw.dll PID 1004 wrote to memory of 1028 1004 cmd.exe Getptw.dll
Processes
-
C:\Users\Admin\AppData\Local\Temp\962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe"C:\Users\Admin\AppData\Local\Temp\962c826c4f851b29d1140cfc73c379fe72f13a1ac04e0f549cc15a8440321b05.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WININST~144\ComInfo.dllC:\Users\Admin\AppData\Roaming\WININST~144\ComInfo.dll2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WININST~144\ShowDrive.dl_ *2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WININST~144\ShowDrive.dl_C:\Users\Admin\AppData\Roaming\WININST~144\ShowDrive.dl_ *3⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WININST~144\Getptw.dll -a/part2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WININST~144\ShowEFI.dl_2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WININST~144\Getptw.dllC:\Users\Admin\AppData\Roaming\WININST~144\Getptw.dll -a/part1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\WININST~144\ShowEFI.dl_C:\Users\Admin\AppData\Roaming\WININST~144\ShowEFI.dl_1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WININST~144\ComInfo.dll
-
C:\Users\Admin\AppData\Roaming\WININST~144\ComInfo.dll
-
C:\Users\Admin\AppData\Roaming\WININST~144\Computer.dll
-
C:\Users\Admin\AppData\Roaming\WININST~144\Computer.dll
-
C:\Users\Admin\AppData\Roaming\WININST~144\Getptw.dll
-
C:\Users\Admin\AppData\Roaming\WININST~144\Getptw.dll
-
C:\Users\Admin\AppData\Roaming\WININST~144\ShowDrive.dl_
-
C:\Users\Admin\AppData\Roaming\WININST~144\ShowDrive.dl_
-
C:\Users\Admin\AppData\Roaming\WININST~144\ShowEFI.dl_
-
C:\Users\Admin\AppData\Roaming\WININST~144\ShowEFI.dl_
-
\Users\Admin\AppData\Roaming\WININST~144\ComInfo.dll
-
\Users\Admin\AppData\Roaming\WININST~144\ComInfo.dll
-
\Users\Admin\AppData\Roaming\WININST~144\Getptw.dll
-
\Users\Admin\AppData\Roaming\WININST~144\Getptw.dll
-
\Users\Admin\AppData\Roaming\WININST~144\ShowDrive.dl_
-
\Users\Admin\AppData\Roaming\WININST~144\ShowDrive.dl_
-
\Users\Admin\AppData\Roaming\WININST~144\ShowEFI.dl_
-
\Users\Admin\AppData\Roaming\WININST~144\ShowEFI.dl_
-
memory/564-65-0x0000000000000000-mapping.dmp
-
memory/1004-73-0x0000000000000000-mapping.dmp
-
memory/1028-77-0x0000000000000000-mapping.dmp
-
memory/1188-71-0x0000000000000000-mapping.dmp
-
memory/1720-67-0x0000000000000000-mapping.dmp
-
memory/1944-54-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1988-61-0x0000000000000000-mapping.dmp
-
memory/2024-57-0x0000000000000000-mapping.dmp