Analysis
-
max time kernel
103s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 16:04
Static task
static1
Behavioral task
behavioral1
Sample
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe
Resource
win10v2004-20220414-en
General
-
Target
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe
-
Size
3.4MB
-
MD5
bde658028be8d6983c7212e1f550be81
-
SHA1
0be7bb34651d1226cd2030ef495316536540668e
-
SHA256
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5
-
SHA512
836af2244eda3ee6922c091604a24c89f42499a7cb1cf9194a0ab73b01232132abc4a616a326fdab2548cb614a65ea539d49f43d083dee54848f54181150b855
Malware Config
Extracted
raccoon
c4376f037b1703b305ca5fb81f6ffc21
http://45.8.144.53/
http://77.91.73.154/
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe -
ModiLoader Second Stage 39 IoCs
Processes:
resource yara_rule behavioral2/memory/948-145-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-146-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-148-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-147-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-150-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-149-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-151-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-152-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-154-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-153-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-156-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-155-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-157-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-159-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-158-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-161-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-160-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-163-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-162-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-164-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-165-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-166-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-168-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-167-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-170-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-169-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-175-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-174-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-176-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-178-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-177-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-186-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-185-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-187-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-188-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-189-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-190-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-191-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 behavioral2/memory/948-192-0x0000000008690000-0x00000000086C5000-memory.dmp modiloader_stage2 -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe -
Processes:
resource yara_rule behavioral2/memory/948-130-0x0000000000B90000-0x0000000000F0A000-memory.dmp themida behavioral2/memory/948-131-0x0000000000B90000-0x0000000000F0A000-memory.dmp themida behavioral2/memory/948-134-0x0000000000B90000-0x0000000000F0A000-memory.dmp themida -
Processes:
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exepid process 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exepid process 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exedescription pid process target process PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe PID 948 wrote to memory of 4868 948 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe 2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe"C:\Users\Admin\AppData\Local\Temp\2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exeC:\Users\Admin\AppData\Local\Temp\2aba51a94cffeab90191cc734940b87a06bcf84611d666dd80671c1ea0b9fbf5.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-164-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-189-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-132-0x0000000077D30000-0x0000000077ED3000-memory.dmpFilesize
1.6MB
-
memory/948-134-0x0000000000B90000-0x0000000000F0A000-memory.dmpFilesize
3.5MB
-
memory/948-135-0x0000000077D30000-0x0000000077ED3000-memory.dmpFilesize
1.6MB
-
memory/948-145-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-146-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-148-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-147-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-150-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-149-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-151-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-152-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-154-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-163-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-156-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-155-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-157-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-159-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-158-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-161-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-160-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-153-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-131-0x0000000000B90000-0x0000000000F0A000-memory.dmpFilesize
3.5MB
-
memory/948-173-0x0000000010410000-0x0000000010422000-memory.dmpFilesize
72KB
-
memory/948-165-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-166-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-168-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-167-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-170-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-169-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-193-0x0000000077D30000-0x0000000077ED3000-memory.dmpFilesize
1.6MB
-
memory/948-130-0x0000000000B90000-0x0000000000F0A000-memory.dmpFilesize
3.5MB
-
memory/948-175-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-174-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-176-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-178-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-177-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-186-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-185-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-187-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-188-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-162-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-190-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-191-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/948-192-0x0000000008690000-0x00000000086C5000-memory.dmpFilesize
212KB
-
memory/4868-172-0x0000000000000000-mapping.dmp
-
memory/4868-194-0x0000000010410000-0x0000000010422000-memory.dmpFilesize
72KB