Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 09:26
Static task
static1
Behavioral task
behavioral1
Sample
0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe
Resource
win7-20220414-en
General
-
Target
0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe
-
Size
1.4MB
-
MD5
10bdc120c93912b9b937ad16cc7a13c9
-
SHA1
0a22badfd2f33aebe32d4689f11abbc31211d5ae
-
SHA256
dfb89b62125470adc70f0e24636633c45d0841aa8e84d09b6bab99f437e2f576
-
SHA512
6b438edf1e591f485974085959634265096a42ef6148c74fe125f622e1f9667e543952fae8ee812d02990ca2566435a44b161383c3fcb58cfe4bb65f6c58530d
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
cmd.execmd.exeGetX64BTIT.exepid process 980 cmd.exe 908 cmd.exe 1236 GetX64BTIT.exe -
Loads dropped DLL 3 IoCs
Processes:
notepad.execmd.exepid process 1224 notepad.exe 1224 notepad.exe 908 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 api.ipify.org 8 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\fc.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0a22badfd2f33aebe32d4689f11abbc31211d5ae.exenotepad.execmd.exepid process 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe 1224 notepad.exe 1224 notepad.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe 908 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
notepad.exepid process 1224 notepad.exe 1224 notepad.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0a22badfd2f33aebe32d4689f11abbc31211d5ae.exedescription pid process Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: 33 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe Token: SeIncBasePriorityPrivilege 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 908 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a22badfd2f33aebe32d4689f11abbc31211d5ae.exenotepad.exedescription pid process target process PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1824 wrote to memory of 1224 1824 0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe notepad.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 980 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe PID 1224 wrote to memory of 908 1224 notepad.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe"C:\Users\Admin\AppData\Local\Temp\0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\cmd.exeFilesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
C:\Users\Admin\AppData\Local\Temp\cmd.exeFilesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD555d7a9d81a671fbdd9b4aff7bafddf50
SHA161d8e49f5b2813196ffc6ec5ffce3506438769c9
SHA256143c2dd25b8fa2f4f42b5975a6685017de3d52aa3b4ac038eee099bb6562ceba
SHA51272a1f66cff4e8c3a9534e664775f1eca4e36bd7bfb1eabe2c2a03d82dfcdc4f5fdd61b1be594cc111cf0cf48193890ee1cd52707ff585fffba5ab9c40f69f9af
-
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
\Users\Admin\AppData\Local\Temp\cmd.exeFilesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
\Users\Admin\AppData\Local\Temp\cmd.exeFilesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
memory/908-66-0x0000000000000000-mapping.dmp
-
memory/908-70-0x0000000076FD0000-0x0000000077179000-memory.dmpFilesize
1.7MB
-
memory/908-83-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/908-82-0x0000000000240000-0x000000000025F000-memory.dmpFilesize
124KB
-
memory/908-81-0x0000000010000000-0x0000000010016000-memory.dmpFilesize
88KB
-
memory/908-76-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/908-69-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1224-55-0x0000000000000000-mapping.dmp
-
memory/1224-75-0x00000000045E7000-0x00000000045F7000-memory.dmpFilesize
64KB
-
memory/1224-56-0x0000000075E41000-0x0000000075E43000-memory.dmpFilesize
8KB
-
memory/1224-60-0x0000000076FD0000-0x0000000077179000-memory.dmpFilesize
1.7MB
-
memory/1224-58-0x0000000000360000-0x0000000000368000-memory.dmpFilesize
32KB
-
memory/1224-65-0x00000000045E7000-0x00000000045F7000-memory.dmpFilesize
64KB
-
memory/1224-59-0x00000000045E0000-0x0000000004664000-memory.dmpFilesize
528KB
-
memory/1236-78-0x0000000000000000-mapping.dmp
-
memory/1824-54-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/1824-57-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB