Analysis
-
max time kernel
1601s -
max time network
1610s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 17:35
Static task
static1
Behavioral task
behavioral1
Sample
Set-up-lighter.exe
Resource
win7-20221111-en
General
-
Target
Set-up-lighter.exe
-
Size
5.8MB
-
MD5
6424ba9f7c036fa497c991018a09e182
-
SHA1
f8c0bde1d722805c874eae92d776610aa10306fe
-
SHA256
7e04e86e08094ab27371e4b9d5307f47a16043300b48a928273b1314f8a9daca
-
SHA512
e78bb0d1c824396ed720d805df8c19510321b13e34aa7dcaeb79c4e20c5faf44a8c6f056e8629bcc74b2bfdecb201afcd9c1636664ba318cbb7e63b80f5be47b
-
SSDEEP
98304:jxLMYUeMsfIOmQg40J1iZkfd7YkmU8uDSrf82pznNsLbZoiY:VMYUe3fwQv07iERBOrfBKo
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
97341182566578190883.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 97341182566578190883.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
97341182566578190883.exepid process 892 97341182566578190883.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
97341182566578190883.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 97341182566578190883.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 97341182566578190883.exe -
Loads dropped DLL 8 IoCs
Processes:
AddInProcess32.exeWerFault.exepid process 1152 AddInProcess32.exe 1152 AddInProcess32.exe 1152 AddInProcess32.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe -
Processes:
resource yara_rule \ProgramData\97341182566578190883.exe themida C:\ProgramData\97341182566578190883.exe themida C:\ProgramData\97341182566578190883.exe themida behavioral1/memory/892-7984-0x0000000000A60000-0x0000000001280000-memory.dmp themida behavioral1/memory/892-7985-0x0000000000A60000-0x0000000001280000-memory.dmp themida \ProgramData\97341182566578190883.exe themida \ProgramData\97341182566578190883.exe themida \ProgramData\97341182566578190883.exe themida \ProgramData\97341182566578190883.exe themida \ProgramData\97341182566578190883.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
97341182566578190883.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 97341182566578190883.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
97341182566578190883.exepid process 892 97341182566578190883.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Set-up-lighter.exedescription pid process target process PID 1780 set thread context of 1152 1780 Set-up-lighter.exe AddInProcess32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1852 892 WerFault.exe 97341182566578190883.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AddInProcess32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AddInProcess32.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1084 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Set-up-lighter.exeAddInProcess32.exe97341182566578190883.exepid process 1780 Set-up-lighter.exe 1152 AddInProcess32.exe 892 97341182566578190883.exe 892 97341182566578190883.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
97341182566578190883.exedescription pid process Token: SeDebugPrivilege 892 97341182566578190883.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Set-up-lighter.exedescription pid process target process PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe PID 1780 wrote to memory of 1152 1780 Set-up-lighter.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Set-up-lighter.exe"C:\Users\Admin\AppData\Local\Temp\Set-up-lighter.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\97341182566578190883.exe"C:\ProgramData\97341182566578190883.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 892 -s 6044⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
C:\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
\ProgramData\97341182566578190883.exeFilesize
8.1MB
MD5e08805d6085d6402dcaeb253e4375a09
SHA12c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
memory/892-7985-0x0000000000A60000-0x0000000001280000-memory.dmpFilesize
8.1MB
-
memory/892-7982-0x0000000000A60000-0x0000000001280000-memory.dmpFilesize
8.1MB
-
memory/892-7983-0x0000000076F40000-0x00000000770E9000-memory.dmpFilesize
1.7MB
-
memory/892-7976-0x0000000000000000-mapping.dmp
-
memory/892-7984-0x0000000000A60000-0x0000000001280000-memory.dmpFilesize
8.1MB
-
memory/892-7992-0x0000000000A60000-0x0000000001280000-memory.dmpFilesize
8.1MB
-
memory/892-7993-0x0000000076F40000-0x00000000770E9000-memory.dmpFilesize
1.7MB
-
memory/1084-7981-0x0000000000000000-mapping.dmp
-
memory/1152-79-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-111-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-81-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-59-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-82-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-83-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-84-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-85-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-86-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-87-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-88-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-89-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-90-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-91-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-92-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-93-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-94-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-95-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-96-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-97-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-98-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-99-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-100-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-101-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-102-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-103-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-104-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-105-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-106-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-107-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-108-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-109-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-110-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-80-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-112-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-113-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-114-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-115-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-116-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-117-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-118-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-119-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-7968-0x00000000000A3B9C-mapping.dmp
-
memory/1152-60-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-7972-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-78-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-77-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-76-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-75-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-74-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-73-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-62-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-7980-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-72-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-71-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-70-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-69-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-68-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-64-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1152-66-0x0000000000080000-0x00000000000E0000-memory.dmpFilesize
384KB
-
memory/1244-7979-0x0000000000000000-mapping.dmp
-
memory/1780-7971-0x0000000140000000-0x00000001409B5000-memory.dmpFilesize
9.7MB
-
memory/1780-54-0x0000000140000000-0x00000001409B5000-memory.dmpFilesize
9.7MB
-
memory/1780-58-0x0000000140000000-0x00000001409B5000-memory.dmpFilesize
9.7MB
-
memory/1780-57-0x0000000140000000-0x00000001409B5000-memory.dmpFilesize
9.7MB
-
memory/1852-7986-0x0000000000000000-mapping.dmp