Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-03-2023 21:59
Behavioral task
behavioral1
Sample
XWorm V3.1 .exe
Resource
win7-20230220-en
General
-
Target
XWorm V3.1 .exe
-
Size
10.1MB
-
MD5
320526ae9b5dbd99a38d158578c84ccb
-
SHA1
60daf13da5fa663c1e7e67ac113fbb5859264b8c
-
SHA256
91a8aec23ab8e79172c8d7cbf6a733e73157941687eb58e8ffa543b7e721b7ea
-
SHA512
5c62082634d4abc4bc524b268c5bcf476f6a900cba8becc49e143c8b207f0f661e921a26a62df746236f65a9978b7691e541283835056c9c5a6efac0a382cf0f
-
SSDEEP
196608:ih0Avmh7fFbZyD3nvCEg+xyZTEQkM1V8/6zCSR6lGCUOGJ1PldRBo+zoDmAYU:iq1pbqdg+yZTUaCkZXOqdbS
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/Kb8rTgY7
Signatures
-
Async RAT payload 10 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\svchost.exe asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat behavioral1/memory/1400-75-0x0000000000FE0000-0x0000000000FF6000-memory.dmp asyncrat behavioral1/memory/1484-87-0x000000001B700000-0x000000001B780000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat \Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat behavioral1/memory/1572-106-0x00000000000D0000-0x00000000000E6000-memory.dmp asyncrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
XWorm V3.1 .exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XWorm V3.1 .exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XWorm V3.1 .exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XWorm V3.1 .exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1988 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exepid process 1484 XWorm V3.1.exe 1400 svchost.exe 1572 ContainerRuntime.exe -
Loads dropped DLL 4 IoCs
Processes:
XWorm V3.1 .execmd.exepid process 1232 XWorm V3.1 .exe 1232 XWorm V3.1 .exe 1232 XWorm V3.1 .exe 1980 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1232-56-0x0000000000DC0000-0x0000000001D28000-memory.dmp themida behavioral1/memory/1232-58-0x0000000000DC0000-0x0000000001D28000-memory.dmp themida behavioral1/memory/1232-86-0x0000000000DC0000-0x0000000001D28000-memory.dmp themida -
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XWorm V3.1 .exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
XWorm V3.1 .exepid process 1232 XWorm V3.1 .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 2032 timeout.exe 588 timeout.exe -
Processes:
ContainerRuntime.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 ContainerRuntime.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 ContainerRuntime.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
svchost.exeContainerRuntime.exeXWorm V3.1.exepid process 1400 svchost.exe 1572 ContainerRuntime.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe 1484 XWorm V3.1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exedescription pid process Token: SeDebugPrivilege 1484 XWorm V3.1.exe Token: SeDebugPrivilege 1400 svchost.exe Token: SeDebugPrivilege 1572 ContainerRuntime.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
XWorm V3.1.exepid process 1484 XWorm V3.1.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
XWorm V3.1.exepid process 1484 XWorm V3.1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ContainerRuntime.exepid process 1572 ContainerRuntime.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
XWorm V3.1 .execmd.exesvchost.execmd.execmd.exedescription pid process target process PID 1232 wrote to memory of 1484 1232 XWorm V3.1 .exe XWorm V3.1.exe PID 1232 wrote to memory of 1484 1232 XWorm V3.1 .exe XWorm V3.1.exe PID 1232 wrote to memory of 1484 1232 XWorm V3.1 .exe XWorm V3.1.exe PID 1232 wrote to memory of 1484 1232 XWorm V3.1 .exe XWorm V3.1.exe PID 1232 wrote to memory of 1400 1232 XWorm V3.1 .exe svchost.exe PID 1232 wrote to memory of 1400 1232 XWorm V3.1 .exe svchost.exe PID 1232 wrote to memory of 1400 1232 XWorm V3.1 .exe svchost.exe PID 1232 wrote to memory of 1400 1232 XWorm V3.1 .exe svchost.exe PID 1232 wrote to memory of 1988 1232 XWorm V3.1 .exe cmd.exe PID 1232 wrote to memory of 1988 1232 XWorm V3.1 .exe cmd.exe PID 1232 wrote to memory of 1988 1232 XWorm V3.1 .exe cmd.exe PID 1232 wrote to memory of 1988 1232 XWorm V3.1 .exe cmd.exe PID 1988 wrote to memory of 2032 1988 cmd.exe timeout.exe PID 1988 wrote to memory of 2032 1988 cmd.exe timeout.exe PID 1988 wrote to memory of 2032 1988 cmd.exe timeout.exe PID 1988 wrote to memory of 2032 1988 cmd.exe timeout.exe PID 1400 wrote to memory of 888 1400 svchost.exe cmd.exe PID 1400 wrote to memory of 888 1400 svchost.exe cmd.exe PID 1400 wrote to memory of 888 1400 svchost.exe cmd.exe PID 1400 wrote to memory of 888 1400 svchost.exe cmd.exe PID 1400 wrote to memory of 1980 1400 svchost.exe cmd.exe PID 1400 wrote to memory of 1980 1400 svchost.exe cmd.exe PID 1400 wrote to memory of 1980 1400 svchost.exe cmd.exe PID 1400 wrote to memory of 1980 1400 svchost.exe cmd.exe PID 888 wrote to memory of 560 888 cmd.exe schtasks.exe PID 888 wrote to memory of 560 888 cmd.exe schtasks.exe PID 888 wrote to memory of 560 888 cmd.exe schtasks.exe PID 888 wrote to memory of 560 888 cmd.exe schtasks.exe PID 1980 wrote to memory of 588 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 588 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 588 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 588 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 1572 1980 cmd.exe ContainerRuntime.exe PID 1980 wrote to memory of 1572 1980 cmd.exe ContainerRuntime.exe PID 1980 wrote to memory of 1572 1980 cmd.exe ContainerRuntime.exe PID 1980 wrote to memory of 1572 1980 cmd.exe ContainerRuntime.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp541A.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp368C.tmp.bat""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\tmp368C.tmp.batFilesize
163B
MD5b7152b4a35043086ec56c80a1b4b5301
SHA13cd8f79506df5354820afcdd7370c16858eb36f1
SHA2566af73a00d01c01967e146f4be24a7672169dc145f53d350a35248598ed4898e3
SHA512395ad584fe146b8dac1b8944c43dcbf2625a842365d83bd9ac0915c8551df841a3685f16ea389d2e2d07eed4fbc79674ec97ce02bf43fa6da8cc5123a8e05364
-
C:\Users\Admin\AppData\Local\Temp\tmp368C.tmp.batFilesize
163B
MD5b7152b4a35043086ec56c80a1b4b5301
SHA13cd8f79506df5354820afcdd7370c16858eb36f1
SHA2566af73a00d01c01967e146f4be24a7672169dc145f53d350a35248598ed4898e3
SHA512395ad584fe146b8dac1b8944c43dcbf2625a842365d83bd9ac0915c8551df841a3685f16ea389d2e2d07eed4fbc79674ec97ce02bf43fa6da8cc5123a8e05364
-
C:\Users\Admin\AppData\Local\Temp\tmp541A.tmp.batFilesize
160B
MD5468b541760887d4615d6e9d8ad5996f4
SHA1d1b3368fb2e01334850ae9585a2e80612e066c3a
SHA256816af797d2b94a5255e2656fd973a1c62c1b6a13260499091e09fdfd5eb35a85
SHA5121124f645418edb42851c7c3519df9629340a9350b11f91c8b07eb961653f8dee8ece71089eef1fc279dfa4ca37b9dec09161a81c8358ad35529cd51794c0966d
-
C:\Users\Admin\AppData\Local\Temp\tmp541A.tmp.batFilesize
160B
MD5468b541760887d4615d6e9d8ad5996f4
SHA1d1b3368fb2e01334850ae9585a2e80612e066c3a
SHA256816af797d2b94a5255e2656fd973a1c62c1b6a13260499091e09fdfd5eb35a85
SHA5121124f645418edb42851c7c3519df9629340a9350b11f91c8b07eb961653f8dee8ece71089eef1fc279dfa4ca37b9dec09161a81c8358ad35529cd51794c0966d
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
memory/1232-86-0x0000000000DC0000-0x0000000001D28000-memory.dmpFilesize
15.4MB
-
memory/1232-57-0x0000000000DC0000-0x0000000001D28000-memory.dmpFilesize
15.4MB
-
memory/1232-58-0x0000000000DC0000-0x0000000001D28000-memory.dmpFilesize
15.4MB
-
memory/1232-56-0x0000000000DC0000-0x0000000001D28000-memory.dmpFilesize
15.4MB
-
memory/1400-91-0x00000000008C0000-0x0000000000900000-memory.dmpFilesize
256KB
-
memory/1400-75-0x0000000000FE0000-0x0000000000FF6000-memory.dmpFilesize
88KB
-
memory/1484-93-0x000000001B700000-0x000000001B780000-memory.dmpFilesize
512KB
-
memory/1484-85-0x00000000001A0000-0x0000000000896000-memory.dmpFilesize
7.0MB
-
memory/1484-87-0x000000001B700000-0x000000001B780000-memory.dmpFilesize
512KB
-
memory/1484-92-0x000000001B700000-0x000000001B780000-memory.dmpFilesize
512KB
-
memory/1484-88-0x000000001EA70000-0x000000001F5DA000-memory.dmpFilesize
11.4MB
-
memory/1484-108-0x000000001B700000-0x000000001B780000-memory.dmpFilesize
512KB
-
memory/1484-109-0x000000001B700000-0x000000001B780000-memory.dmpFilesize
512KB
-
memory/1484-110-0x000000001B700000-0x000000001B780000-memory.dmpFilesize
512KB
-
memory/1572-106-0x00000000000D0000-0x00000000000E6000-memory.dmpFilesize
88KB
-
memory/1572-107-0x00000000002E0000-0x0000000000320000-memory.dmpFilesize
256KB
-
memory/1572-111-0x00000000002E0000-0x0000000000320000-memory.dmpFilesize
256KB