Analysis
-
max time kernel
150s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:30
Behavioral task
behavioral1
Sample
5f3a8fb712dbdf218be6e8f27793d38fc478c3ab1093611ee2e2fb83e77f071f.dll
Resource
win7-20220901-en
General
-
Target
5f3a8fb712dbdf218be6e8f27793d38fc478c3ab1093611ee2e2fb83e77f071f.dll
-
Size
592KB
-
MD5
440dbfa1e015df5e19fbe780dbd15dc1
-
SHA1
96e7a86082ae7689cb162c62fd15df75cc608871
-
SHA256
5f3a8fb712dbdf218be6e8f27793d38fc478c3ab1093611ee2e2fb83e77f071f
-
SHA512
a49ca3e4f593cd509755de7e47ec75efca11f23800c36342a20d32e210ec964c6368edd76cf25d7d5ae22ae24f3c9194c6fefca6aef4ab74671f955409883ec5
-
SSDEEP
12288:MgUYcOj5s7qoYnw3uXa5tTuUFupP6+Zp4zz:MmVoqeuXa5txGPPOz
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 4776 rundll32mgr.exe 2180 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/4776-141-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4776-142-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4776-146-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2180-148-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2180-150-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2180-155-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2180-156-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2180-157-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2180-158-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2180-159-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Processes:
resource yara_rule behavioral2/memory/2628-133-0x00000000749B0000-0x0000000074A50000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
Processes:
rundll32mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px2B75.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3776 1560 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3083981656" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998436" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3090857156" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375415440" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998436" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998436" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3090857156" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998436" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3083981656" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3090857156" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DDD68E8E-6B97-11ED-BF5F-FAE5CAF4041A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3090857156" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998436" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998436" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DDD6B59E-6B97-11ED-BF5F-FAE5CAF4041A} = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe 2180 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 2180 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 3592 iexplore.exe 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 3592 iexplore.exe 3592 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 3548 IEXPLORE.EXE 564 IEXPLORE.EXE 3548 IEXPLORE.EXE 564 IEXPLORE.EXE 564 IEXPLORE.EXE 564 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 4776 rundll32mgr.exe 2180 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 1356 wrote to memory of 2628 1356 rundll32.exe rundll32.exe PID 1356 wrote to memory of 2628 1356 rundll32.exe rundll32.exe PID 1356 wrote to memory of 2628 1356 rundll32.exe rundll32.exe PID 2628 wrote to memory of 4776 2628 rundll32.exe rundll32mgr.exe PID 2628 wrote to memory of 4776 2628 rundll32.exe rundll32mgr.exe PID 2628 wrote to memory of 4776 2628 rundll32.exe rundll32mgr.exe PID 4776 wrote to memory of 2180 4776 rundll32mgr.exe WaterMark.exe PID 4776 wrote to memory of 2180 4776 rundll32mgr.exe WaterMark.exe PID 4776 wrote to memory of 2180 4776 rundll32mgr.exe WaterMark.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 1560 2180 WaterMark.exe svchost.exe PID 2180 wrote to memory of 3592 2180 WaterMark.exe iexplore.exe PID 2180 wrote to memory of 3592 2180 WaterMark.exe iexplore.exe PID 2180 wrote to memory of 1936 2180 WaterMark.exe iexplore.exe PID 2180 wrote to memory of 1936 2180 WaterMark.exe iexplore.exe PID 1936 wrote to memory of 564 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 564 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 564 1936 iexplore.exe IEXPLORE.EXE PID 3592 wrote to memory of 3548 3592 iexplore.exe IEXPLORE.EXE PID 3592 wrote to memory of 3548 3592 iexplore.exe IEXPLORE.EXE PID 3592 wrote to memory of 3548 3592 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f3a8fb712dbdf218be6e8f27793d38fc478c3ab1093611ee2e2fb83e77f071f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f3a8fb712dbdf218be6e8f27793d38fc478c3ab1093611ee2e2fb83e77f071f.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 2126⤵
- Program crash
PID:3776 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3548 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1560 -ip 15601⤵PID:444
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DDD68E8E-6B97-11ED-BF5F-FAE5CAF4041A}.datFilesize
5KB
MD573db546c34ebf5f50a10d3e173cb88aa
SHA1ee524f959003d8081691d073d78dd20c79e371e1
SHA2564cef0d57bbb9b4b40beaba2003272547f26d03237168c8a05f7da627bdcc3856
SHA512ecbd310ef3de59a32196461b0c60e08e418f82083ceee8ac336828baafffe46648f7b74aa8bba0abe9080e767dd5072ed59e71ec270272af2c9748ad344e8585
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DDD6B59E-6B97-11ED-BF5F-FAE5CAF4041A}.datFilesize
5KB
MD5cc9e5d3668eadacd7163cf5dc53199d2
SHA1f72fe5c517be0211970d5678c925c7891371fa41
SHA25676f72a13e4e406db53d909649766fac083a1256c10468b399ebc0e336b60473a
SHA51296a6c25546e40f3d8ae0a925427edd13c0ef86e3e5e5cd3e6eebb678219869792802b1b4b244dbbbaad702900ad9cc9f99e5ff5b692b0900d6d30eaa1c36b74b
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350
-
memory/1560-154-0x0000000000000000-mapping.dmp
-
memory/2180-143-0x0000000000000000-mapping.dmp
-
memory/2180-158-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2180-159-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2180-148-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2180-150-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2180-155-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2180-156-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2180-157-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2628-132-0x0000000000000000-mapping.dmp
-
memory/2628-133-0x00000000749B0000-0x0000000074A50000-memory.dmpFilesize
640KB
-
memory/4776-141-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4776-146-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4776-142-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4776-136-0x0000000000000000-mapping.dmp